CVE-2026-99265 - Vulnerability Details

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Linux	Linux Linux Kernel

No data.

References

No reference.

History

Wed, 04 Nov 2026 16:30:00 +0000

Type	Values Removed	Values Added
References	https://git.kernel.org/stable/c/7299a32764ab875443b58581d929027954dcf24c https://git.kernel.org/stable/c/a3d7ee11289f657aa9af826d8f0844221292a27a https://git.kernel.org/stable/c/b4b7b2d19dab611f3cf3d052aa19278e7e4c4683

Wed, 04 Nov 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description	In the Linux kernel, the following vulnerability has been resolved: io_uring/openclose: keep the lock in io_pipe_fixed() io_pipe_fixed() installs both ends of the pipe in the fixed file table, drops ->uring_lock, and copies the slot numbers to the application. If that faults, it takes the lock again and removes whatever is in these slots. If the request is run by io-wq the lock really is dropped in between, and the slots are visible to everybody else. By the time the error path gets to them, they may have been closed and reused, by IORING_OP_CLOSE and a direct open or accept, or by IORING_REGISTER_FILES_UPDATE. Then a file is removed from the table that has nothing to do with the failed request. Do the copy with the lock held. Faulting in user memory under ->uring_lock is fine, the registration paths do it all the time.	This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Title	io_uring/openclose: keep the lock in io_pipe_fixed()
CPEs	cpe:2.3:o:linux:linux_kernel::::::::

Tue, 03 Nov 2026 19:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/a3d7ee11289f657aa9af826d8f0844221292a27a

Tue, 03 Nov 2026 14:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Tue, 03 Nov 2026 13:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362

Tue, 03 Nov 2026 12:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: io_uring/openclose: keep the lock in io_pipe_fixed() io_pipe_fixed() installs both ends of the pipe in the fixed file table, drops ->uring_lock, and copies the slot numbers to the application. If that faults, it takes the lock again and removes whatever is in these slots. If the request is run by io-wq the lock really is dropped in between, and the slots are visible to everybody else. By the time the error path gets to them, they may have been closed and reused, by IORING_OP_CLOSE and a direct open or accept, or by IORING_REGISTER_FILES_UPDATE. Then a file is removed from the table that has nothing to do with the failed request. Do the copy with the lock held. Faulting in user memory under ->uring_lock is fine, the registration paths do it all the time.
Title		io_uring/openclose: keep the lock in io_pipe_fixed()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/7299a32764ab875443b58581d929027954dcf24c https://git.kernel.org/stable/c/b4b7b2d19dab611f3cf3d052aa19278e7e4c4683