CVE-2026-43366 Details
Description
In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: check if target buffer list is still legacy on recycle There's a gap between when the buffer was grabbed and when it potentially gets recycled, where if the list is empty, someone could've upgraded it to a ring provided type. This can happen if the request is forced via io-wq. The legacy recycling is missing checking if the buffer_list still exists, and if it's of the correct type. Add those checks.
A vulnerability in the Linux kernel's io_uring implementation can lead to improper handling of buffer recycling. This issue arises because there is a gap between when a buffer is acquired and when it may be recycled. If the buffer list is empty, it could be upgraded to a ring-provided type, especially when the request is processed via the I/O workqueue. The current legacy recycling process fails to verify if the buffer list is still valid and of the correct type, potentially allowing for incorrect buffer management.
Users can upgrade to the patched version of the Linux kernel where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/439a6728ec4641ffad1ca796622c19bc525e570f | kernel.org | Patch |
| https://git.kernel.org/stable/c/50ad880db3013c6fee0ef13781762a39e2e7ef83 | kernel.org | Patch |
| https://git.kernel.org/stable/c/97b57f69fee1b61b41acbf37e7720cac9d389fa4 | kernel.org | Patch |
| https://git.kernel.org/stable/c/a7b33671e418fca507feebd1d56e7f4952a4b25c | kernel.org | Patch |
| https://git.kernel.org/stable/c/c2c185be5c85d37215397c8e8781abf0a69bec1f | kernel.org | Patch |
| https://git.kernel.org/stable/c/f3fb54e7a8b4aadcc2836ee463eec8c88709b8aa | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.19, < 6.1.167 >= 6.2, < 6.6.130 >= 6.7, < 6.12.78 >= 6.13, < 6.18.19 >= 6.19, < 6.19.9 7.0 rc1 7.0 rc2 7.0 rc3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 15, 2026 | Initial Analysis | [email protected] |
| May 11, 2026 | CVE Modified | kernel.org |
| May 8, 2026 | New CVE Received | kernel.org |