Linux Kernel: Io_uring Hash Node Leave Poison Leads to KASAN & Crash
CVE-2026-99230 Published on November 2, 2026
io_uring/cmd: don't leave list poison in ->hash_node
In the Linux kernel, the following vulnerability has been resolved:
io_uring/cmd: don't leave list poison in ->hash_node
io_uring_cmd_del_cancelable() uses hlist_del() to take a command off
->cancelable_uring_cmd, which leaves LIST_POISON1/2 behind in
->hash_node. Requests are recycled through the request cache without
being reinitialised, and not every user of ->hash_node sets it up before
it is used:
If a vectored futex wait is woken while futex_wait_multiple_setup() is
still queueing the futexes, io_futexv_wait() doesn't add the request to
->futex_list, and leaves the completion to the task_work queued by the
wake up. io_futexv_complete() ends in __io_futex_complete(), whose
hlist_del_init() is fine for a request that is unhashed, which is how all
other users of the node leave it. If the request was a cancelable
uring_cmd in its previous life, e.g. a ublk FETCH_REQ, it writes through
LIST_POISON2:
Oops: general protection fault, probably for non-canonical address
KASAN: maybe wild-memory-access in range [0xdead000000000120-...]
RIP: 0010:io_futexv_complete+0x219/0x420
Call Trace:
tctx_task_work_run+0x804/0x950
tctx_task_work+0x71/0xa0
task_work_run+0x118/0x200
Leave the node unhashed.
Products Associated with CVE-2026-99230
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 93b8cc60c37b9d17732b7a297e5dca29b50a990d and below cc7f13d006fcefed9564bd79f135b51d344e9c77 is affected.
- Version 93b8cc60c37b9d17732b7a297e5dca29b50a990d and below 2d5af21422060c088f6e4fb0f1e7dcf5bcdd6707 is affected.
- Version 93b8cc60c37b9d17732b7a297e5dca29b50a990d and below 685b49483200384d7f49d338af476e26e6824637 is affected.
- Version 6.7 is affected.
- Before 6.7 is unaffected.
- Version 6.12.115, <= 6.12.* is unaffected.
- Version 6.18.60, <= 6.18.* is unaffected.
- Version 7.2.14, <= 7.2.* is unaffected.