Linux Kernel Vulnerability in I/O Operations Affecting Multiple Distributions

CVE-2026-99265

What is CVE-2026-99265?

A vulnerability in the Linux kernel's I/O subsystem allows for potential data exposure due to improper locking mechanisms in the io_uring interface. When utilizing the io_pipe_fixed() function, the lock is released prematurely, exposing slot numbers in the fixed file table to other processes. This may lead to unexpected behavior, where slots may be accessed or repurposed by competing requests, creating a risk of data corruption and unintended file operations. To mitigate this issue, developers should ensure that necessary locks remain held when accessing application-specific slot numbers during I/O operations.

References