{"api_version":"1","generated_at":"2026-11-01T09:41:03+00:00","cve":"CVE-2026-99203","urls":{"html":"https://cve.report/CVE-2026-99203","api":"https://cve.report/api/cve/CVE-2026-99203.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-99203","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-99203"},"summary":{"title":"pipe: preserve existing fasync readers on writer setup failure","description":"In the Linux kernel, the following vulnerability has been resolved:\n\npipe: preserve existing fasync readers on writer setup failure\n\nF_SETFL and FIOASYNC decide whether to invoke ->fasync() before\npipe_fasync() takes pipe->mutex. Two enables of one O_RDWR FIFO can\ntherefore both enter the callback.\n\nfasync_helper() allocates before checking for an existing entry. If the\nfirst enable installs both entries, a second enable can update the\nreader entry and then fail the allocation for the writer entry. The\nerror path removes the pre-existing reader entry, clearing FASYNC while\nthe writer entry remains registered. __fput() then skips ->fasync(), so a\nlater pipe notification can dereference the freed file or its f_owner.\nAn unprivileged memory-pressure reproducer triggers a KASAN\nslab-use-after-free in send_sigio() through this path.\n\nKeep the reader helper's result and undo the registration only if this\ncall added it. The pipe mutex serializes changes to both lists, so a\nfailed new registration still removes its reader, while a failed\nduplicate preserves the existing registrations and FASYNC. Successful\nduplicate enables continue to update fa_fd as before.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-10-28 11:17:41","updated_at":"2026-10-31 13:17:59"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/2259809e5b7043c4ba20af7b14ba3e471cf55521","name":"https://git.kernel.org/stable/c/2259809e5b7043c4ba20af7b14ba3e471cf55521","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/6041bcd185d4df051490fe166e64feae6c3b8291","name":"https://git.kernel.org/stable/c/6041bcd185d4df051490fe166e64feae6c3b8291","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/7cdbfa22a7e270b155ddb958b1583a999c0c8abb","name":"https://git.kernel.org/stable/c/7cdbfa22a7e270b155ddb958b1583a999c0c8abb","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/9b0aa2a1d8df51f3dcb363c3a2d9531098e88dc6","name":"https://git.kernel.org/stable/c/9b0aa2a1d8df51f3dcb363c3a2d9531098e88dc6","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/94be790dd6fbe0912f35bb711bea8ef3687eaca9","name":"https://git.kernel.org/stable/c/94be790dd6fbe0912f35bb711bea8ef3687eaca9","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/4c42ce499ce4b1c787e61082e3b13df4f30c4eaa","name":"https://git.kernel.org/stable/c/4c42ce499ce4b1c787e61082e3b13df4f30c4eaa","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/40bb03d3ea6f6a915218508819ecc4d7a7fa260d","name":"https://git.kernel.org/stable/c/40bb03d3ea6f6a915218508819ecc4d7a7fa260d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/22c7f57b0c0b0b8e19cfb41a1bd85f55715ad386","name":"https://git.kernel.org/stable/c/22c7f57b0c0b0b8e19cfb41a1bd85f55715ad386","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-99203","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99203","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 76398425bb06b07cc3a3b1ce169c67dc9d6874ed 6041bcd185d4df051490fe166e64feae6c3b8291 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 76398425bb06b07cc3a3b1ce169c67dc9d6874ed 7cdbfa22a7e270b155ddb958b1583a999c0c8abb git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 76398425bb06b07cc3a3b1ce169c67dc9d6874ed 22c7f57b0c0b0b8e19cfb41a1bd85f55715ad386 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 76398425bb06b07cc3a3b1ce169c67dc9d6874ed 94be790dd6fbe0912f35bb711bea8ef3687eaca9 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 76398425bb06b07cc3a3b1ce169c67dc9d6874ed 9b0aa2a1d8df51f3dcb363c3a2d9531098e88dc6 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 76398425bb06b07cc3a3b1ce169c67dc9d6874ed 4c42ce499ce4b1c787e61082e3b13df4f30c4eaa git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 76398425bb06b07cc3a3b1ce169c67dc9d6874ed 2259809e5b7043c4ba20af7b14ba3e471cf55521 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 76398425bb06b07cc3a3b1ce169c67dc9d6874ed 40bb03d3ea6f6a915218508819ecc4d7a7fa260d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2.6.30","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 2.6.30 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.273 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.224 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.191 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.161 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.115 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.59 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.13 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"99203","cve":"CVE-2026-99203","epss":"0.001710000","percentile":"0.064400000","score_date":"2026-10-31","updated_at":"2026-11-01 00:01:49"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/pipe.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6041bcd185d4df051490fe166e64feae6c3b8291","status":"affected","version":"76398425bb06b07cc3a3b1ce169c67dc9d6874ed","versionType":"git"},{"lessThan":"7cdbfa22a7e270b155ddb958b1583a999c0c8abb","status":"affected","version":"76398425bb06b07cc3a3b1ce169c67dc9d6874ed","versionType":"git"},{"lessThan":"22c7f57b0c0b0b8e19cfb41a1bd85f55715ad386","status":"affected","version":"76398425bb06b07cc3a3b1ce169c67dc9d6874ed","versionType":"git"},{"lessThan":"94be790dd6fbe0912f35bb711bea8ef3687eaca9","status":"affected","version":"76398425bb06b07cc3a3b1ce169c67dc9d6874ed","versionType":"git"},{"lessThan":"9b0aa2a1d8df51f3dcb363c3a2d9531098e88dc6","status":"affected","version":"76398425bb06b07cc3a3b1ce169c67dc9d6874ed","versionType":"git"},{"lessThan":"4c42ce499ce4b1c787e61082e3b13df4f30c4eaa","status":"affected","version":"76398425bb06b07cc3a3b1ce169c67dc9d6874ed","versionType":"git"},{"lessThan":"2259809e5b7043c4ba20af7b14ba3e471cf55521","status":"affected","version":"76398425bb06b07cc3a3b1ce169c67dc9d6874ed","versionType":"git"},{"lessThan":"40bb03d3ea6f6a915218508819ecc4d7a7fa260d","status":"affected","version":"76398425bb06b07cc3a3b1ce169c67dc9d6874ed","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/pipe.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.30"},{"lessThan":"2.6.30","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.273","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.224","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.161","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.115","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.59","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.273","versionStartIncluding":"2.6.30","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.224","versionStartIncluding":"2.6.30","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.191","versionStartIncluding":"2.6.30","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.161","versionStartIncluding":"2.6.30","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.115","versionStartIncluding":"2.6.30","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.59","versionStartIncluding":"2.6.30","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.13","versionStartIncluding":"2.6.30","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3","versionStartIncluding":"2.6.30","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npipe: preserve existing fasync readers on writer setup failure\n\nF_SETFL and FIOASYNC decide whether to invoke ->fasync() before\npipe_fasync() takes pipe->mutex. Two enables of one O_RDWR FIFO can\ntherefore both enter the callback.\n\nfasync_helper() allocates before checking for an existing entry. If the\nfirst enable installs both entries, a second enable can update the\nreader entry and then fail the allocation for the writer entry. The\nerror path removes the pre-existing reader entry, clearing FASYNC while\nthe writer entry remains registered. __fput() then skips ->fasync(), so a\nlater pipe notification can dereference the freed file or its f_owner.\nAn unprivileged memory-pressure reproducer triggers a KASAN\nslab-use-after-free in send_sigio() through this path.\n\nKeep the reader helper's result and undo the registration only if this\ncall added it. The pipe mutex serializes changes to both lists, so a\nfailed new registration still removes its reader, while a failed\nduplicate preserves the existing registrations and FASYNC. Successful\nduplicate enables continue to update fa_fd as before."}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - An attacker reaches the patched pipe_fasync() only through local fcntl(fd,F_SETFL,...O_ASYNC) or ioctl(fd,FIOASYNC,...) on an O_RDWR FIFO; no protocol packet supplies the triggering state.\nAC:L - Two attacker threads control both enable calls and can retry the filp->f_flags race; fasync_cache is SLAB_ACCOUNT, and the fix reports an unprivileged memory-pressure reproducer that makes the duplicate writer allocation fail.\nPR:L - mknodat(...,S_IFIFO,...) reaches vfs_mknod() without CAP_MKNOD because that check covers only block and character nodes, and neither F_SETFL nor FIOASYNC requires a capability on the caller's FIFO descriptor.\nUI:N - The attacker creates and opens the FIFO, races asynchronous enablement, closes the stale file, and reads the retained FIFO to invoke anon_pipe_read()->kill_fasync(); no victim action is needed.\nS:U - The stale pipe fasync entry corrupts objects used by kill_fasync_rcu() and send_sigio() inside the same kernel security authority; this is ordinary local kernel privilege escalation, not a VM or IOMMU boundary crossing.\nC:H - kill_fasync_rcu() reads fa_file->f_owner after both the file and owner can have been freed, and send_sigio() follows reclaimed fown->pid and credential fields; reclaiming these slabs provides a fake-object arbitrary-read primitive.\nI:H - send_sigio() acquires fown->lock and acts on fown->pid through the freed, reclaimable owner, writing lock and signal/task state through attacker-shaped pointers; this UAF is exploitable memory corruption rather than a read-only stale access.\nA:H - The fix reports a reproduced KASAN slab-use-after-free in send_sigio(); the stale lock and pid dereferences during anon_pipe_read() notification can oops, panic, or hang the kernel."}]}],"providerMetadata":{"dateUpdated":"2026-10-31T12:45:00.735Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/6041bcd185d4df051490fe166e64feae6c3b8291"},{"url":"https://git.kernel.org/stable/c/7cdbfa22a7e270b155ddb958b1583a999c0c8abb"},{"url":"https://git.kernel.org/stable/c/22c7f57b0c0b0b8e19cfb41a1bd85f55715ad386"},{"url":"https://git.kernel.org/stable/c/94be790dd6fbe0912f35bb711bea8ef3687eaca9"},{"url":"https://git.kernel.org/stable/c/9b0aa2a1d8df51f3dcb363c3a2d9531098e88dc6"},{"url":"https://git.kernel.org/stable/c/4c42ce499ce4b1c787e61082e3b13df4f30c4eaa"},{"url":"https://git.kernel.org/stable/c/2259809e5b7043c4ba20af7b14ba3e471cf55521"},{"url":"https://git.kernel.org/stable/c/40bb03d3ea6f6a915218508819ecc4d7a7fa260d"}],"title":"pipe: preserve existing fasync readers on writer setup failure","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-99203","datePublished":"2026-10-28T10:35:57.589Z","dateReserved":"2026-09-25T10:25:14.400Z","dateUpdated":"2026-10-31T12:45:00.735Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-28 11:17:41","lastModifiedDate":"2026-10-31 13:17:59","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"99203","Ordinal":"1","Title":"pipe: preserve existing fasync readers on writer setup failure","CVE":"CVE-2026-99203","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"99203","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\npipe: preserve existing fasync readers on writer setup failure\n\nF_SETFL and FIOASYNC decide whether to invoke ->fasync() before\npipe_fasync() takes pipe->mutex. Two enables of one O_RDWR FIFO can\ntherefore both enter the callback.\n\nfasync_helper() allocates before checking for an existing entry. If the\nfirst enable installs both entries, a second enable can update the\nreader entry and then fail the allocation for the writer entry. The\nerror path removes the pre-existing reader entry, clearing FASYNC while\nthe writer entry remains registered. __fput() then skips ->fasync(), so a\nlater pipe notification can dereference the freed file or its f_owner.\nAn unprivileged memory-pressure reproducer triggers a KASAN\nslab-use-after-free in send_sigio() through this path.\n\nKeep the reader helper's result and undo the registration only if this\ncall added it. The pipe mutex serializes changes to both lists, so a\nfailed new registration still removes its reader, while a failed\nduplicate preserves the existing registrations and FASYNC. Successful\nduplicate enables continue to update fa_fd as before.","Type":"Description","Title":"pipe: preserve existing fasync readers on writer setup failure"}]}}}