Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-99265— io_uring/openclose: keep the lock in io_pipe_fixed()

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： io_uring/openclose：在 io_pipe_fixed() 中保持锁的持有状态 io_pipe_fixed() 会将管道的两端安装到固定文件表中，随后释放 ->uring_lock，并将槽位编号复制给用户空间应用程序。如果此复制操作发生页面错误（fault），函数会重新获取锁，并清除这些槽位中的内容。当该请求由 io-wq 线程执行时，锁确实会在中间被释放，导致这些槽位对所有其他线程可见。等到错误处理路径执行到这些槽位时，它们可能已被关闭并重新使用（例如

AI Predicted 7.8 Difficulty: Moderate Updated Nov 04, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 8

Vendor	Product	Version Range	Status
Linux	Linux	`53db8a71ecb42c2ec5e9c6925269a750255f9af5< b4b7b2d19dab611f3cf3d052aa19278e7e4c4683`	affected
		`53db8a71ecb42c2ec5e9c6925269a750255f9af5< 7299a32764ab875443b58581d929027954dcf24c`	affected
		`53db8a71ecb42c2ec5e9c6925269a750255f9af5< a3d7ee11289f657aa9af826d8f0844221292a27a`	affected
		`6.16`	affected
		`< 6.16`	unaffected
		`6.18.60≤ 6.18.*`	unaffected
		`7.2.14≤ 7.2.*`	unaffected
		`7.4-rc1≤ *`	unaffected

Updated Nov 04, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

io_uring/openclose: keep the lock in io_pipe_fixed()

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: io_uring/openclose: keep the lock in io_pipe_fixed() io_pipe_fixed() installs both ends of the pipe in the fixed file table, drops ->uring_lock, and copies the slot numbers to the application. If that faults, it takes the lock again and removes whatever is in these slots. If the request is run by io-wq the lock really is dropped in between, and the slots are visible to everybody else. By the time the error path gets to them, they may have been closed and reused, by IORING_OP_CLOSE and a direct open or accept, or by IORING_REGISTER_FILES_UPDATE. Then a file is removed from the table that has nothing to do with the failed request. Do the copy with the lock held. Faulting in user memory under ->uring_lock is fine, the registration paths do it all the time.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	53db8a71ecb42c2ec5e9c6925269a750255f9af5 ~ b4b7b2d19dab611f3cf3d052aa19278e7e4c4683	-
Linux	Linux	6.16	-

II. Public POCs for CVE-2026-99265

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-99265

请登录查看更多情报信息。

Other References for CVE-2026-99265 (3)

https://www.cve.org/CVERecord?id=CVE-2026-99265

Same Patch Batch · Linux · 2026-11-03 · 28 CVEs total

CVE-2026-99270	8.1 HIGH	tcp: Fix potential UAF in reqsk_timer_handler().
CVE-2026-99246	8.1 HIGH	tipc: protect node reset trace dump with node lock
CVE-2026-99269	7.8 HIGH	sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs
CVE-2026-99264	7.8 HIGH	io_uring/net: don't retry recv on uncommitted buffers
CVE-2026-99243		io-wq: order the exit bit against worker creation task work
CVE-2026-99245		KEYS: Fix key_reject_and_link() race with keyring restriction
CVE-2026-99244		pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper
CVE-2026-99248		i2c: xiic: restore non-managed runtime PM to fix clk WARN flood
CVE-2026-99247		tracing: Do not initialize tracefs work if tracing is disabled
CVE-2026-99249		pid_namespace: make zap_pid_ns_processes() freezable
CVE-2026-99250		printk: Postpone kthread startup
CVE-2026-99251		Drivers: hv: Avoid infinite retry loop in init_vp_index()
CVE-2026-99252		io_uring/mpscq: disable preemption while pushing
CVE-2026-99253		io_uring/cancel: rearm local work wake up before sleep
CVE-2026-99255		io_uring/io-wq: don't hide a link from cancellations
CVE-2026-99254		io_uring: don't flood a cancelling task with task_work
CVE-2026-99257		gpio: shared: gracefully handle no-device lookup of shared GPIOs
CVE-2026-99256		dm cache: fix issue with background work locking
CVE-2026-99259		soc/tegra: pmc: Fix uninitialised clock rate
CVE-2026-99258		x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()

Showing top 20 of 28 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux