Linux Kernel Vulnerability in io_uring Registration Process

CVE-2026-99096

What is CVE-2026-99096?

A security flaw exists in the Linux kernel's io_uring registration process where a disabled ring can bypass task restrictions. This vulnerability allows the creator of such a ring to register restrictions and later enable it regardless of the opcodes in the allowed set. The issue arises from the exemption granted to rings created with IORING_SETUP_R_DISABLED, which can lead to unauthorized access to restricted functionality. Proper checks and task restrictions must be enforced even when the ring is in a disabled state to ensure system integrity and security.

References