CVE-2026-99227

A flaw was found in the Linux kernel's io_uring subsystem. A local attacker can repeatedly issue cancellation requests for asynchronous waitid operations, causing an internal reference counter to overflow and wrap to zero. This flaw leads to a use-after-free memory corruption condition, potentially allowing the attacker to cause a Denial of Service (DoS) system crash or escalate privileges.

This vulnerability is rated as an Important severity flaw because an unprivileged local user can leverage repeated asynchronous wait cancellation requests to induce memory corruption and potentially achieve local privilege escalation or crash the kernel. Although exploitation requires existing local system access, default system configurations permit unprivileged callers to interact with io_uring operations without special capabilities. Successful exploitation compromises the integrity and confidentiality of the host kernel, posing a significant risk in multi-tenant or containerized environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

--- CME Mitigation Guidance (2026-11-04) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to restrict unprivileged user access to the io_uring subsystem to prevent asynchronous cancellation requests from reaching kernel waitid logic: upgrade to the corresponding fixed Red Hat builds, which use atomic_fetch_or to inspect the prior cancel flag and return immediately without incrementing the reference counter if the cancel flag was already set, closing repeated cancellation requests on io_uring waitid operations. Until patched, this is only a concern on Linux systems allowing unprivileged users to submit io_uring operations — Non-Linux platforms are unaffected — so restrict unprivileged local users from submitting io_uring operations or interacting with asynchronous waitid requests. As a compensating measure, enable Kernel AddressSanitizer to detect use-after-free memory access caused by io_uring double completions, enable SLAB freelist randomization and pointer integrity validation to detect heap layout manipulation during use-after-free exploitation, maintain SELinux in enforcing mode to confine processes and limit lateral movement following privilege escalation, deploy endpoint detection agents to detect post-exploitation payload deployment and privilege escalation behaviors, deploy eBPF runtime security monitoring to detect anomalous kernel activity and unauthorized privilege elevation attempts, and enforce hardware non-executable page protections to prevent execution of injected code residing in kernel heap memory. These controls limit blast radius and contain exploitation, but they do not fix the underlying reference counter wrap defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)