Linux Kernel io_uring Fixed File Table Lock Race
CVE-2026-99265 Published on November 3, 2026
io_uring/openclose: keep the lock in io_pipe_fixed()
In the Linux kernel, the following vulnerability has been resolved:
io_uring/openclose: keep the lock in io_pipe_fixed()
io_pipe_fixed() installs both ends of the pipe in the fixed file table,
drops ->uring_lock, and copies the slot numbers to the application. If
that faults, it takes the lock again and removes whatever is in these
slots.
If the request is run by io-wq the lock really is dropped in between, and
the slots are visible to everybody else. By the time the error path gets
to them, they may have been closed and reused, by IORING_OP_CLOSE and a
direct open or accept, or by IORING_REGISTER_FILES_UPDATE. Then a file is
removed from the table that has nothing to do with the failed request.
Do the copy with the lock held. Faulting in user memory under
->uring_lock is fine, the registration paths do it all the time.
Products Associated with CVE-2026-99265
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 53db8a71ecb42c2ec5e9c6925269a750255f9af5 and below b4b7b2d19dab611f3cf3d052aa19278e7e4c4683 is affected.
- Version 53db8a71ecb42c2ec5e9c6925269a750255f9af5 and below 7299a32764ab875443b58581d929027954dcf24c is affected.
- Version 6.16 is affected.
- Before 6.16 is unaffected.
- Version 6.18.60, <= 6.18.* is unaffected.
- Version 7.2.14, <= 7.2.* is unaffected.