CVE-2026-46315

A flaw was found in the Linux kernel's io_uring subsystem, specifically within the IORING_OP_WAITID operation. This vulnerability occurs because the waitid information structure is not properly initialized before being copied to userspace. A local user could exploit this to expose stale data from previously used kernel memory, leading to information disclosure.

This vulnerability is rated as Moderate impact because exploiting it requires an authenticated local user capable of issuing specific io_uring requests, limiting the potential blast radius to unprivileged information leakage rather than system compromise or denial of service. Under typical enterprise deployments, exposure is restricted to environments where unprivileged users can initiate asynchronous I/O requests. While uninitialized command buffer contents may be returned to user memory, the leaked data is limited to residual bytes from previous kernel operations and does not allow modifying system state or elevating privileges.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.