io_uring/cmd: don't leave list poison in ->hash_node
Summary
| CVE | CVE-2026-99230 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-02 16:17:47 UTC |
| Updated | 2026-11-06 18:18:33 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: io_uring/cmd: don't leave list poison in ->hash_node io_uring_cmd_del_cancelable() uses hlist_del() to take a command off ->cancelable_uring_cmd, which leaves LIST_POISON1/2 behind in ->hash_node. Requests are recycled through the request cache without being reinitialised, and not every user of ->hash_node sets it up before it is used: If a vectored futex wait is woken while futex_wait_multiple_setup() is still queueing the futexes, io_futexv_wait() doesn't add the request to ->futex_list, and leaves the completion to the task_work queued by the wake up. io_futexv_complete() ends in __io_futex_complete(), whose hlist_del_init() is fine for a request that is unhashed, which is how all other users of the node leave it. If the request was a cancelable uring_cmd in its previous life, e.g. a ublk FETCH_REQ, it writes through LIST_POISON2: Oops: general protection fault, probably for non-canonical address KASAN: maybe wild-memory-access in range [0xdead000000000120-...] RIP: 0010:io_futexv_complete+0x219/0x420 Call Trace: tctx_task_work_run+0x804/0x950 tctx_task_work+0x71/0xa0 task_work_run+0x118/0x200 Leave the node unhashed. |
Risk And Classification
EPSS: 0.001550000 probability, percentile 0.046460000 (date 2026-11-03)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected 93b8cc60c37b9d17732b7a297e5dca29b50a990d cc7f13d006fcefed9564bd79f135b51d344e9c77 git | Not specified |
| CNA | Linux | Linux | affected 93b8cc60c37b9d17732b7a297e5dca29b50a990d 2d5af21422060c088f6e4fb0f1e7dcf5bcdd6707 git | Not specified |
| CNA | Linux | Linux | affected 93b8cc60c37b9d17732b7a297e5dca29b50a990d 685b49483200384d7f49d338af476e26e6824637 git | Not specified |
| CNA | Linux | Linux | affected 93b8cc60c37b9d17732b7a297e5dca29b50a990d c4fe1024b2f3f40f8010591a0c0ad541e2883eda git | Not specified |
| CNA | Linux | Linux | affected 93b8cc60c37b9d17732b7a297e5dca29b50a990d 4c83e39f4d1944d7146fd06094f2c8053238d55c git | Not specified |
| CNA | Linux | Linux | affected 6.7 | Not specified |
| CNA | Linux | Linux | unaffected 6.7 semver | Not specified |
| CNA | Linux | Linux | unaffected 6.12.115 6.12.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18.60 6.18.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.2.14 7.2.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.3.2 7.3.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.4-rc1 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/4c83e39f4d1944d7146fd06094f2c8053238d55c | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/c4fe1024b2f3f40f8010591a0c0ad541e2883eda | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/2d5af21422060c088f6e4fb0f1e7dcf5bcdd6707 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/cc7f13d006fcefed9564bd79f135b51d344e9c77 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/685b49483200384d7f49d338af476e26e6824637 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.