CVE-2026-99227
Description
A flaw was found in the Linux kernel's io_uring subsystem. A local attacker can repeatedly issue cancellation requests for asynchronous waitid operations, causing an internal reference counter to overflow and wrap to zero. This flaw leads to a use-after-free memory corruption condition, potentially allowing the attacker to cause a Denial of Service (DoS) system crash or escalate privileges.
Statement
This vulnerability is rated as an Important severity flaw because an unprivileged local user can leverage repeated asynchronous wait cancellation requests to induce memory corruption and potentially achieve local privilege escalation or crash the kernel. Although exploitation requires existing local system access, default system configurations permit unprivileged callers to interact with io_uring operations without special capabilities. Successful exploitation compromises the integrity and confidentiality of the host kernel, posing a significant risk in multi-tenant or containerized environments.
Mitigation
--- CME Mitigation Guidance (2026-11-04) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to restrict unprivileged user access to the io_uring subsystem to prevent asynchronous cancellation requests from reaching kernel waitid logic: upgrade to the corresponding fixed Red Hat builds, which use atomic_fetch_or to inspect the prior cancel flag and return immediately without incrementing the reference counter if the cancel flag was already set, closing repeated cancellation requests on io_uring waitid operations. Until patched, this is only a concern on Linux systems allowing unprivileged users to submit io_uring operations — Non-Linux platforms are unaffected — so restrict unprivileged local users from submitting io_uring operations or interacting with asynchronous waitid requests. As a compensating measure, enable Kernel AddressSanitizer to detect use-after-free memory access caused by io_uring double completions, enable SLAB freelist randomization and pointer integrity validation to detect heap layout manipulation during use-after-free exploitation, maintain SELinux in enforcing mode to confine processes and limit lateral movement following privilege escalation, deploy endpoint detection agents to detect post-exploitation payload deployment and privilege escalation behaviors, deploy eBPF runtime security monitoring to detect anomalous kernel activity and unauthorized privilege elevation attempts, and enforce hardware non-executable page protections to prevent execution of injected code residing in kernel heap memory. These controls limit blast radius and contain exploitation, but they do not fix the underlying reference counter wrap defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.8 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
If an adversary can prevent a reference count from reaching zero, then resources might not be released when they are supposed to, thus causing resources to become scarce for future needs.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
If an adversary can cause a reference count to reach zero when the resource is still in use, then a resource might be released before it is supposed to be, possibly forcing an error that causes the product to crash or exit out of its current operation.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
