CVE-2026-99230

A flaw was found in the Linux kernel's io_uring subsystem. When cancelable commands are removed, recycled request objects can retain stale list pointers instead of being cleanly reinitialized. A local attacker can trigger this issue by submitting specific asynchronous I/O requests, causing the kernel to dereference invalid memory. This flaw leads to a system crash, resulting in a Denial of Service (DoS).

This vulnerability is classified as Moderate severity for Red Hat because successful exploitation requires local access and solely impacts system availability through an unexpected kernel crash. The issue stems from improperly reinitialized request tracking nodes within the kernel's io_uring asynchronous subsystem, causing invalid pointer dereferences when specific vectored operations interact with recycled commands. Exploitation cannot be triggered remotely and does not enable privilege escalation or data confidentiality loss, limiting the impact to a local denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.