{
  "cveId": "CVE-2026-99231",
  "url": "https://patchblox.com/security/cve/CVE-2026-99231",
  "summary": "CVE-2026-99231 is fixed in linux on 1 platform by DEBIAN-CVE-2026-99231 (version 6.12.115-1), released November 3, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  io_uring/waitid: own the request before clearing...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  io_uring/waitid: own the request before clearing -\u003Ehead  io_waitid_remove_wq() only takes the wait queue lock if -\u003Ehead is set. io_waitid_wait() clears -\u003Ehead first thing, before it tries to become the owner of the request by bumping -\u003Erefs. If somebody else owns the request at that point, nothing keeps it from completing the request while the wake up handler is still going to touch it:  CPU0 (io_waitid_wait)                 CPU1 (io_waitid, holds a ref) list_del_init(\u0026wait-\u003Eentry) smp_store_release(\u0026iw-\u003Ehead, NULL)                                       __do_wait() finds another child                                       io_waitid_remove_wq()                                         // -\u003Ehead == NULL, no locking                                       io_waitid_finish(), IOU_COMPLETE                                       // request freed and reused atomic_fetch_inc(\u0026iw-\u003Erefs)  The same goes for __io_waitid_cancel() if it claims the request in that window. -\u003Erefs is part of the per opcode data of the request, so this increments whatever the next user of the request keeps there. If that happens to be zero, the handler concludes that it owns the request, and queues io_waitid_cb() for it. With the window held open by a delay, and the request reused for a receive that is waiting for data:    BUG: KASAN: slab-use-after-free in __wake_up_common\u002B0x1ca/0x1f0    __wake_up_sync_key\u002B0x36/0x50    sock_def_readable\u002B0xf1/0x420    unix_stream_sendmsg\u002B0x60b/0x1110   Allocated by task 87:    io_arm_apoll\u002B0x1ed/0x940   Freed by task 87:    __io_submit_flush_completions\u002B0x118d/0x1a10    tctx_task_work_run\u002B0x327/0x950  Only clear -\u003Ehead once the handler owns the request. If it doesn\u0027t, the owner finds -\u003Ehead set and has to wait for the lock, which is held by the caller of the handler. Deleting the already deleted entry again is harmless.",
  "published": "2026-11-02T16:17:48Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00117,
  "epssPercentile": 0.0166,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.115-1",
      "fix": "DEBIAN-CVE-2026-99231",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-99231",
      "released": "2026-11-03T18:58:21Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}