{"id":"CVE-2026-99230","summary":"io_uring/cmd: don't leave list poison in -\u003ehash_node","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/cmd: don't leave list poison in -\u003ehash_node\n\nio_uring_cmd_del_cancelable() uses hlist_del() to take a command off\n-\u003ecancelable_uring_cmd, which leaves LIST_POISON1/2 behind in\n-\u003ehash_node. Requests are recycled through the request cache without\nbeing reinitialised, and not every user of -\u003ehash_node sets it up before\nit is used:\n\nIf a vectored futex wait is woken while futex_wait_multiple_setup() is\nstill queueing the futexes, io_futexv_wait() doesn't add the request to\n-\u003efutex_list, and leaves the completion to the task_work queued by the\nwake up. io_futexv_complete() ends in __io_futex_complete(), whose\nhlist_del_init() is fine for a request that is unhashed, which is how all\nother users of the node leave it. If the request was a cancelable\nuring_cmd in its previous life, e.g. a ublk FETCH_REQ, it writes through\nLIST_POISON2:\n\n  Oops: general protection fault, probably for non-canonical address\n  KASAN: maybe wild-memory-access in range [0xdead000000000120-...]\n  RIP: 0010:io_futexv_complete+0x219/0x420\n  Call Trace:\n   tctx_task_work_run+0x804/0x950\n   tctx_task_work+0x71/0xa0\n   task_work_run+0x118/0x200\n\nLeave the node unhashed.","modified":"2026-11-10T17:27:01.374587953Z","published":"2026-11-02T16:06:37.984Z","related":["openSUSE-SU-2026:12497-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99230.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/2d5af21422060c088f6e4fb0f1e7dcf5bcdd6707"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4c83e39f4d1944d7146fd06094f2c8053238d55c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/685b49483200384d7f49d338af476e26e6824637"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c4fe1024b2f3f40f8010591a0c0ad541e2883eda"},{"type":"WEB","url":"https://git.kernel.org/stable/c/cc7f13d006fcefed9564bd79f135b51d344e9c77"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99230.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99230"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"93b8cc60c37b9d17732b7a297e5dca29b50a990d"},{"fixed":"cc7f13d006fcefed9564bd79f135b51d344e9c77"},{"fixed":"2d5af21422060c088f6e4fb0f1e7dcf5bcdd6707"},{"fixed":"685b49483200384d7f49d338af476e26e6824637"},{"fixed":"c4fe1024b2f3f40f8010591a0c0ad541e2883eda"},{"fixed":"4c83e39f4d1944d7146fd06094f2c8053238d55c"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-99230.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.115"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.60"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.14"}]},{"type":"ECOSYSTEM","events":[{"introduced":"7.3.0"},{"fixed":"7.3.2"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-99230.json"}}],"schema_version":"1.9.2"}