Read the docs
TI-2026-84228 Aliases CVE-2026-99266GHSA-fpm3-962w-m24h

Integer truncation in io_uring zcrx buffer offsets in Linux kernel

Priority LOW 22Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from CNA.

Summary

The Linux kernel io_uring zero-copy receive (zcrx) code computes buffer offsets in 32 bits, so areas above 4GB point to the wrong buffer. The shift overflows before the result is widened to a 64-bit value in the completion queue entry. Applications that use affected areas read the wrong data and may be handed a buffer they do not own through the refill queue while the real buffer is never returned. Affected versions are from 6.15 before 6.18.60, and from 6.15 before 7.2.14 and 7.4-rc1 in their respective branches.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix buffer offsets in areas above 4GB io_zcrx_queue_cqe() computes the offset of the buffer in its area from net_iov_idx(), which is an unsigned int, so the shift is done in 32 bits and only the result is widened to the u64 that goes into the CQE. An area can be up to 1TB in size. For every niov beyond the first 4GB the CQE points the application at a buffer 4GB, or a multiple of that, below the one which has the data. It reads the wrong data, and then returns a buffer it doesn't own via the refill queue while the real one is never given back.

Why it matters now

EPSS 0.00189 8th percentileScored 2026-11-04
Fix Fixed Linux (Linux): 6.18.60, 7.2.14, 7.4-rc1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
LinuxLinux6.15 and later6.18.60, 7.2.14, 7.4-rc1Patch availableCNA
  • Linux VendorLinux Affected 6.15 and later Fixed in 6.18.60, 7.2.14, 7.4-rc1 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*——Linux
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions — — ·Linux

Remediation

Fixed versions for Linux are 6.18.60, 7.2.14 and 7.4-rc1. The sources list no fixed version for Linux in other branches.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Linux (Linux) Fixed in 6.18.60, 7.2.14, 7.4-rc1

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-99266
  2. 2026-11-03 Alias added: GHSA-fpm3-962w-m24h
  3. 2026-11-03 Fix available: Linux/[email protected], Linux/Linux@ab4536bf2e5617b04f2d9396f06393c7bbfb071d · CNA
  4. 2026-11-03 1 new reference · CNA

References

Other 3

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2021-02452 Incorrect authorization in Ubuntu linux kernel KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
See all 21741 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences