GHSA-43W7-GR43-GV9H
Vulnerability from github – Published: 2026-11-02 18:32 – Updated: 2026-11-03 21:32In the Linux kernel, the following vulnerability has been resolved:
io_uring/cmd: don't leave list poison in ->hash_node
io_uring_cmd_del_cancelable() uses hlist_del() to take a command off ->cancelable_uring_cmd, which leaves LIST_POISON1/2 behind in ->hash_node. Requests are recycled through the request cache without being reinitialised, and not every user of ->hash_node sets it up before it is used:
If a vectored futex wait is woken while futex_wait_multiple_setup() is still queueing the futexes, io_futexv_wait() doesn't add the request to ->futex_list, and leaves the completion to the task_work queued by the wake up. io_futexv_complete() ends in __io_futex_complete(), whose hlist_del_init() is fine for a request that is unhashed, which is how all other users of the node leave it. If the request was a cancelable uring_cmd in its previous life, e.g. a ublk FETCH_REQ, it writes through LIST_POISON2:
Oops: general protection fault, probably for non-canonical address KASAN: maybe wild-memory-access in range [0xdead000000000120-...] RIP: 0010:io_futexv_complete+0x219/0x420 Call Trace: tctx_task_work_run+0x804/0x950 tctx_task_work+0x71/0xa0 task_work_run+0x118/0x200
Leave the node unhashed.
{
"affected": [],
"aliases": [
"CVE-2026-99230"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-11-02T16:17:47Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/cmd: don\u0027t leave list poison in -\u003ehash_node\n\nio_uring_cmd_del_cancelable() uses hlist_del() to take a command off\n-\u003ecancelable_uring_cmd, which leaves LIST_POISON1/2 behind in\n-\u003ehash_node. Requests are recycled through the request cache without\nbeing reinitialised, and not every user of -\u003ehash_node sets it up before\nit is used:\n\nIf a vectored futex wait is woken while futex_wait_multiple_setup() is\nstill queueing the futexes, io_futexv_wait() doesn\u0027t add the request to\n-\u003efutex_list, and leaves the completion to the task_work queued by the\nwake up. io_futexv_complete() ends in __io_futex_complete(), whose\nhlist_del_init() is fine for a request that is unhashed, which is how all\nother users of the node leave it. If the request was a cancelable\nuring_cmd in its previous life, e.g. a ublk FETCH_REQ, it writes through\nLIST_POISON2:\n\n Oops: general protection fault, probably for non-canonical address\n KASAN: maybe wild-memory-access in range [0xdead000000000120-...]\n RIP: 0010:io_futexv_complete+0x219/0x420\n Call Trace:\n tctx_task_work_run+0x804/0x950\n tctx_task_work+0x71/0xa0\n task_work_run+0x118/0x200\n\nLeave the node unhashed.",
"id": "GHSA-43w7-gr43-gv9h",
"modified": "2026-11-03T21:32:00Z",
"published": "2026-11-02T18:32:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99230"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2d5af21422060c088f6e4fb0f1e7dcf5bcdd6707"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4c83e39f4d1944d7146fd06094f2c8053238d55c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/685b49483200384d7f49d338af476e26e6824637"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cc7f13d006fcefed9564bd79f135b51d344e9c77"
}
],
"schema_version": "1.4.0",
"severity": []
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.