Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-99266— io_uring/zcrx: fix buffer offsets in areas above 4GB

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： io_uring/zcrx：修复了 4GB 以上区域的缓冲区偏移问题函数通过计算缓冲区在其所属区域中的偏移量。由于返回的是无符号 32 位整数（unsigned int），因此位移运算在 32 位下进行，仅将最终结果扩展为 64 位（u64）后写入完成队列条目（CQE）。然而，一个区域的大小最大可达 1TB。对于超出前 4GB 的每个（IOV 数量），CQE 会将应用程序引导至实际数据缓冲区下方 4GB 或其整数倍的位置。这导致应用程序读取了错误的数据，并通过回

AI Predicted 8.8 Difficulty: Moderate Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application

Affected Version Matrix 8

Vendor	Product	Version Range	Status
Linux	Linux	`11ed914bbf948c4a37248f2876973ac18014056d< 9bfb315e2d0907fbcaf5d0453dd6d873c9aa8d5b`	affected
		`11ed914bbf948c4a37248f2876973ac18014056d< 51f4ee29bf0564e6ae7d3540693a9bc1dd2c8fd7`	affected
		`11ed914bbf948c4a37248f2876973ac18014056d< ab4536bf2e5617b04f2d9396f06393c7bbfb071d`	affected
		`6.15`	affected
		`< 6.15`	unaffected
		`6.18.60≤ 6.18.*`	unaffected
		`7.2.14≤ 7.2.*`	unaffected
		`7.4-rc1≤ *`	unaffected

Updated Nov 04, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

io_uring/zcrx: fix buffer offsets in areas above 4GB

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix buffer offsets in areas above 4GB io_zcrx_queue_cqe() computes the offset of the buffer in its area from net_iov_idx(), which is an unsigned int, so the shift is done in 32 bits and only the result is widened to the u64 that goes into the CQE. An area can be up to 1TB in size. For every niov beyond the first 4GB the CQE points the application at a buffer 4GB, or a multiple of that, below the one which has the data. It reads the wrong data, and then returns a buffer it doesn't own via the refill queue while the real one is never given back.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	11ed914bbf948c4a37248f2876973ac18014056d ~ 9bfb315e2d0907fbcaf5d0453dd6d873c9aa8d5b	-
Linux	Linux	6.15	-

II. Public POCs for CVE-2026-99266

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-99266

请登录查看更多情报信息。

Other References for CVE-2026-99266 (3)

https://www.cve.org/CVERecord?id=CVE-2026-99266

Same Patch Batch · Linux · 2026-11-03 · 28 CVEs total

CVE-2026-99270	8.1 HIGH	tcp: Fix potential UAF in reqsk_timer_handler().
CVE-2026-99246	8.1 HIGH	tipc: protect node reset trace dump with node lock
CVE-2026-99269	7.8 HIGH	sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs
CVE-2026-99264	7.8 HIGH	io_uring/net: don't retry recv on uncommitted buffers
CVE-2026-99243		io-wq: order the exit bit against worker creation task work
CVE-2026-99245		KEYS: Fix key_reject_and_link() race with keyring restriction
CVE-2026-99244		pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper
CVE-2026-99248		i2c: xiic: restore non-managed runtime PM to fix clk WARN flood
CVE-2026-99247		tracing: Do not initialize tracefs work if tracing is disabled
CVE-2026-99249		pid_namespace: make zap_pid_ns_processes() freezable
CVE-2026-99250		printk: Postpone kthread startup
CVE-2026-99251		Drivers: hv: Avoid infinite retry loop in init_vp_index()
CVE-2026-99252		io_uring/mpscq: disable preemption while pushing
CVE-2026-99253		io_uring/cancel: rearm local work wake up before sleep
CVE-2026-99255		io_uring/io-wq: don't hide a link from cancellations
CVE-2026-99254		io_uring: don't flood a cancelling task with task_work
CVE-2026-99257		gpio: shared: gracefully handle no-device lookup of shared GPIOs
CVE-2026-99256		dm cache: fix issue with background work locking
CVE-2026-99259		soc/tegra: pmc: Fix uninitialised clock rate
CVE-2026-99258		x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()

Showing top 20 of 28 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux