CVE-2026-43366

io_uring/kbuf: check if target buffer list is still legacy on recycle

State: Published
Severity: 7.8 High
Published: May 8, 2026
Updated: Oct 19, 2026
Reserved: May 1, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

io_uring/kbuf: check if target buffer list is still legacy on recycle

There's a gap between when the buffer was grabbed and when it potentially gets recycled, where if the list is empty, someone could've upgraded it to a ring provided type. This can happen if the request is forced via io-wq. The legacy recycling is missing checking if the buffer_list still exists, and if it's of the correct type. Add those checks.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
LinuxLinux	c7fb19428d67dd0a2a78a4f237af01d39c78dc5a to before a7b33671e418fca507feebd1d56e7f4952a4b25cAffected c7fb19428d67dd0a2a78a4f237af01d39c78dc5a to before 439a6728ec4641ffad1ca796622c19bc525e570fAffected c7fb19428d67dd0a2a78a4f237af01d39c78dc5a to before f3fb54e7a8b4aadcc2836ee463eec8c88709b8aaAffected c7fb19428d67dd0a2a78a4f237af01d39c78dc5a to before 50ad880db3013c6fee0ef13781762a39e2e7ef83Affected c7fb19428d67dd0a2a78a4f237af01d39c78dc5a to before 97b57f69fee1b61b41acbf37e7720cac9d389fa4Affected c7fb19428d67dd0a2a78a4f237af01d39c78dc5a to before c2c185be5c85d37215397c8e8781abf0a69bec1fAffected
LinuxLinux	5.19Affected before 5.19Not affected 6.1.167 through 6.1.Not affected 6.6.130 through 6.6.Not affected 6.12.78 through 6.12.Not affected 6.18.19 through 6.18.Not affected 6.19.9 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

c7fb19428d67dd0a2a78a4f237af01d39c78dc5a to before a7b33671e418fca507feebd1d56e7f4952a4b25cAffected
c7fb19428d67dd0a2a78a4f237af01d39c78dc5a to before 439a6728ec4641ffad1ca796622c19bc525e570fAffected
c7fb19428d67dd0a2a78a4f237af01d39c78dc5a to before f3fb54e7a8b4aadcc2836ee463eec8c88709b8aaAffected
c7fb19428d67dd0a2a78a4f237af01d39c78dc5a to before 50ad880db3013c6fee0ef13781762a39e2e7ef83Affected
c7fb19428d67dd0a2a78a4f237af01d39c78dc5a to before 97b57f69fee1b61b41acbf37e7720cac9d389fa4Affected
c7fb19428d67dd0a2a78a4f237af01d39c78dc5a to before c2c185be5c85d37215397c8e8781abf0a69bec1fAffected

LinuxLinux

5.19Affected
before 5.19Not affected
6.1.167 through 6.1.*Not affected
6.6.130 through 6.6.*Not affected
6.12.78 through 6.12.*Not affected
6.18.19 through 6.18.*Not affected
6.19.9 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.