CVE-2026-99230io_uring/cmd: don't leave list poison in ->hash_node
- —Not scoredno CVSS score yet
- 0.16%Exploitation in 30 daysEPSS · top 95% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: io_uring/cmd: don't leave list poison in ->hash_node io_uring_cmd_del_cancelable() uses hlist_del() to take a command off ->cancelable_uring_cmd, which leaves LIST_POISON1/2 behind in ->hash_node. Requests are recycled through the request cache without being reinitialised, and not every user of ->hash_node sets it up before it is used: If a vectored futex wait is woken while futex_wait_multiple_setup() is still queueing the futexes, io_futexv_wait() doesn't add the request to ->futex_list, and leaves the completion to the task_work queued by the wake up. io_futexv_complete() ends in __io_futex_complete(), whose hlist_del_init() is fine for a request that is unhashed, which is how all other users of the node leave it. If the request was a cancelable uring_cmd in its previous life, e.g. a ublk FETCH_REQ, it writes through LIST_POISON2: Oops: general protection fault, probably for non-canonical address KASAN: maybe wild-memory-access in range [0xdead000000000120-...] RIP: 0010:io_futexv_complete+0x219/0x420 Call Trace: tctx_task_work_run+0x804/0x950 tctx_task_work+0x71/0xa0 task_work_run+0x118/0x200 Leave the node unhashed.
Timeline
ID reserved
By Linux
- 38 days later
· 38 days later
Published
- 4 days later
· 4 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.16% · top 95% of all CVEs (15 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 93b8cc60c37b9d17732b7a297e5dca29b50a990d – < cc7f13d006fcefed9564bd79f135b51d344e9c77
- affected 93b8cc60c37b9d17732b7a297e5dca29b50a990d – < 2d5af21422060c088f6e4fb0f1e7dcf5bcdd6707
- affected 93b8cc60c37b9d17732b7a297e5dca29b50a990d – < 685b49483200384d7f49d338af476e26e6824637
- affected 93b8cc60c37b9d17732b7a297e5dca29b50a990d – < c4fe1024b2f3f40f8010591a0c0ad541e2883eda
- affected 93b8cc60c37b9d17732b7a297e5dca29b50a990d – < 4c83e39f4d1944d7146fd06094f2c8053238d55c
- affected 6.7
- unaffected < 6.7
- unaffected 6.12.115 – ≤ 6.12.*
- unaffected 6.18.60 – ≤ 6.18.*
- unaffected 7.2.14 – ≤ 7.2.*
- unaffected 7.3.2 – ≤ 7.3.*
- unaffected 7.4-rc1 – ≤ *
References
References5
- https://git.kernel.org/stable/c/cc7f13d006fcefed9564bd79f135b51d344e9c77 (opens in a new tab)
- https://git.kernel.org/stable/c/2d5af21422060c088f6e4fb0f1e7dcf5bcdd6707 (opens in a new tab)
- https://git.kernel.org/stable/c/685b49483200384d7f49d338af476e26e6824637 (opens in a new tab)
- https://git.kernel.org/stable/c/c4fe1024b2f3f40f8010591a0c0ad541e2883eda (opens in a new tab)
- https://git.kernel.org/stable/c/4c83e39f4d1944d7146fd06094f2c8053238d55c (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-115272 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-99230)Record last updated .