# CVE-2026-99230: linux: In the Linux kernel, the following vulnerability has been resolved:  io_uring/cmd: don't leave list poison in ->hash_...

CVE-2026-99230 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-99230, released November 3, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-99230
- Priority: Routine
- CVSS: n/a
- EPSS: 0.0016
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Nov 2, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  io_uring/cmd: don't leave list poison in ->hash_node  io_uring_cmd_del_cancelable() uses hlist_del() to take a command off ->cancelable_uring_cmd, which leaves LIST_POISON1/2 behind in ->hash_node. Requests are recycled through the request cache without being reinitialised, and not every user of ->hash_node sets it up before it is used:  If a vectored futex wait is woken while futex_wait_multiple_setup() is still queueing the futexes, io_futexv_wait() doesn't add the request to ->futex_list, and leaves the completion to the task_work queued by the wake up. io_futexv_complete() ends in __io_futex_complete(), whose hlist_del_init() is fine for a request that is unhashed, which is how all other users of the node leave it. If the request was a cancelable uring_cmd in its previous life, e.g. a ublk FETCH_REQ, it writes through LIST_POISON2:    Oops: general protection fault, probably for non-canonical address   KASAN: maybe wild-memory-access in range [0xdead000000000120-...]   RIP: 0010:io_futexv_complete+0x219/0x420   Call Trace:    tctx_task_work_run+0x804/0x950    tctx_task_work+0x71/0xa0    task_work_run+0x118/0x200  Leave the node unhashed.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.12.115-1 | [DEBIAN-CVE-2026-99230](https://patchblox.com/security/data/fix/linux/debian-cve-2026-99230.md) | Nov 3, 2026 |
| Linux | linux Debian 14 | 7.2.14-1 | [DEBIAN-CVE-2026-99230](https://patchblox.com/security/data/fix/linux/debian-cve-2026-99230.md) | Nov 3, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.