CVE-2026-99096

A flaw was found in the Linux kernel's io_uring subsystem. A local user can bypass security restrictions by creating an initially disabled asynchronous I/O ring. Because disabled rings failed to enforce inherited task restrictions prior to activation, an attacker can execute restricted register operations and then enable the ring, circumventing task-level constraints.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.