Read the docs
TI-2026-83895 Aliases CVE-2026-99230GHSA-43w7-gr43-gv9h

Linux kernel io_uring leaves list poison in request hash node

Priority LOW 22Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Partial Red Hat: 4 without a fix

No CVSS vector from any source. Fix status from CNA and Red Hat.

Summary

The Linux kernel from 6.7 contains an io_uring flaw in which io_uring_cmd_del_cancelable() leaves list poison values in a request's hash node. Requests are recycled without reinitialisation, so a vectored futex wait woken during setup can later write through those poisoned pointers. This causes a kernel general protection fault.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

In the Linux kernel, the following vulnerability has been resolved: io_uring/cmd: don't leave list poison in ->hash_node io_uring_cmd_del_cancelable() uses hlist_del() to take a command off ->cancelable_uring_cmd, which leaves LIST_POISON1/2 behind in ->hash_node. Requests are recycled through the request cache without being reinitialised, and not every user of ->hash_node sets it up before it is used: If a vectored futex wait is woken while futex_wait_multiple_setup() is still queueing the futexes, io_futexv_wait() doesn't add the request to ->futex_list, and leaves the completion to the task_work queued by the wake up. io_futexv_complete() ends in __io_futex_complete(), whose hlist_del_init() is fine for a request that is unhashed, which is how all other users of the node leave it. If the request was a cancelable uring_cmd in its previous life, e.g. a ublk FETCH_REQ, it writes through LIST_POISON2: Oops: general protection fault, probably for non-canonical address KASAN: maybe wild-memory-access in range [0xdead000000000120-...] RIP: 0010:io_futexv_complete+0x219/0x420 Call Trace: tctx_task_work_run+0x804/0x950 tctx_task_work+0x71/0xa0 task_work_run+0x118/0x200 Leave the node unhashed.

Why it matters now

EPSS 0.00157 4th percentileScored 2026-11-07
Fix Partial Linux (Linux): 6.12.115, 6.18.60, 7.2.14 +2Red Hat: 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
LinuxLinux6.7 and later6.12.115, 6.18.60, 7.2.14, 7.3.2, 7.4-rc1Patch availableCNA
  • Linux VendorLinux Affected 6.7 and later Fixed in 6.12.115, 6.18.60, 7.2.14, 7.3.2, 7.4-rc1 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*——Linux
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions — — ·Linux

Remediation

Fixed Linux kernel versions are 6.12.115, 6.18.60, 7.2.14, 7.3.2 and 7.4-rc1. Red Hat lists Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 and Red Hat OpenShift Container Platform 5 as affected with no fix available.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Linux (Linux) Fixed in 6.12.115, 6.18.60, 7.2.14, 7.3.2, 7.4-rc1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 5AffectedNo fix yet: Fix deferred
Not affected: 5 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2026-11-02 Threatist record created from CVE-2026-99230
  2. 2026-11-02 Alias added: GHSA-43w7-gr43-gv9h
  3. 2026-11-03 Fix available: Linux/Linux@4c83e39f4d1944d7146fd06094f2c8053238d55c, Linux/[email protected] · CNA
  4. 2026-11-03 1 new reference · CNA
  5. 2026-11-04 Affected versions changed · Red Hat
  6. 2026-11-04 CVSS score added · Red Hat
  7. 2026-11-06 Fix available: Linux/[email protected], Linux/Linux@c4fe1024b2f3f40f8010591a0c0ad541e2883eda · CNA
  8. 2026-11-06 1 new reference · CNA

References

Other 5

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2021-02452 Incorrect authorization in Ubuntu linux kernel KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
See all 21741 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences