watch_queue: Fix note pool publication race in watch_queue_set_size()

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-99179
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-10-28 11:17:38 UTC
Updated2026-10-30 13:21:51 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: watch_queue: Fix note pool publication race in watch_queue_set_size() There is a race between watch_queue_set_size() and post_one_notification(). watch_queue_set_size() publishes wqueue->notes, notes_bitmap, nr_pages and nr_notes with plain stores, and post_one_notification() reads them with plain loads under a different lock, so nothing orders the four stores against the poster's loads: depending on the build, notes can be stored last (gcc 14 on x86-64 does this). Since keyctl_watch_key() lets a watch attach to a queue before it is sized, post_one_notification() can already be running on another CPU at that moment: it reads nr_notes > 0, passes its bounds check, and then reads notes while it is still NULL, dereferencing notes[0]. An unprivileged user triggers this reliably by watching one of its own keys through a notification pipe and racing ioctl(IOC_WATCH_QUEUE_SET_SIZE) on that pipe against keyctl(KEYCTL_SETPERM) on the key from another CPU, triggering: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:post_one_notification.isra.0+0xa2/0x1e0 Call Trace: __post_watch_notification+0x148/0x180 keyctl_setperm_key+0x119/0x130 do_syscall_64+0x108/0x4c0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Kernel panic - not syncing: Fatal exception in interrupt Fix this by publishing nr_notes last with smp_store_release(), and by reading it once with smp_load_acquire() in post_one_notification() before the bitmap and the page array are touched. A poster that observes a non-zero nr_notes then also observes the pool behind it; one that observes zero drops the notification as before.

Risk And Classification

EPSS: 0.001720000 probability, percentile 0.066440000 (date 2026-10-30)

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected c73be61cede5882f9605a852414db559c0ebedfd 2137d487b25eefa862be70de489b64f4c679fe1f git Not specified
CNA Linux Linux affected c73be61cede5882f9605a852414db559c0ebedfd 6aaa6c1a1b61aae332d6e7e0083140b86ea51e14 git Not specified
CNA Linux Linux affected c73be61cede5882f9605a852414db559c0ebedfd 4b20867d80e7e91fb7db531f34035d91591ba405 git Not specified
CNA Linux Linux affected c73be61cede5882f9605a852414db559c0ebedfd da52e5fcb2cae6acdc0d5722ff83499f8232b9d1 git Not specified
CNA Linux Linux affected c73be61cede5882f9605a852414db559c0ebedfd f94c45f83e688e41dfe1b3a589806a0a25567260 git Not specified
CNA Linux Linux affected c73be61cede5882f9605a852414db559c0ebedfd 811fb6d0b07605e8e8d93bde8748be4b3028809a git Not specified
CNA Linux Linux affected c73be61cede5882f9605a852414db559c0ebedfd 9e73a6754457ffed8399b835552013b9363e51d1 git Not specified
CNA Linux Linux affected c73be61cede5882f9605a852414db559c0ebedfd 5e531d62f1f8834faf7a4eed0d41105cf6570a8f git Not specified
CNA Linux Linux affected 5.8 Not specified
CNA Linux Linux unaffected 5.8 semver Not specified
CNA Linux Linux unaffected 5.10.273 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.224 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.191 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.161 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.115 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.59 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.13 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/811fb6d0b07605e8e8d93bde8748be4b3028809a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/9e73a6754457ffed8399b835552013b9363e51d1 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/5e531d62f1f8834faf7a4eed0d41105cf6570a8f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/6aaa6c1a1b61aae332d6e7e0083140b86ea51e14 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/4b20867d80e7e91fb7db531f34035d91591ba405 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/f94c45f83e688e41dfe1b3a589806a0a25567260 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/da52e5fcb2cae6acdc0d5722ff83499f8232b9d1 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/2137d487b25eefa862be70de489b64f4c679fe1f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report