In the Linux kernel, the following vulnerability has been resolved:
io_uring/kbuf: check if target buffer list is still legacy on recycle
There's a gap between when the buffer was grabbed and when it
potentially gets recycled, where if the list is empty, someone could've
upgraded it to a ring provided type. This can happen if the request
is forced via io-wq. The legacy recycling is missing checking if the
buffer_list still exists, and if it's of the correct type. Add those
checks.
References
Configurations
Configuration 1 (hide)
|
History
15 May 2026, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/439a6728ec4641ffad1ca796622c19bc525e570f - Patch | |
| References | () https://git.kernel.org/stable/c/50ad880db3013c6fee0ef13781762a39e2e7ef83 - Patch | |
| References | () https://git.kernel.org/stable/c/97b57f69fee1b61b41acbf37e7720cac9d389fa4 - Patch | |
| References | () https://git.kernel.org/stable/c/a7b33671e418fca507feebd1d56e7f4952a4b25c - Patch | |
| References | () https://git.kernel.org/stable/c/c2c185be5c85d37215397c8e8781abf0a69bec1f - Patch | |
| References | () https://git.kernel.org/stable/c/f3fb54e7a8b4aadcc2836ee463eec8c88709b8aa - Patch | |
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* |
|
| CWE | NVD-CWE-noinfo | |
| First Time |
Linux linux Kernel
Linux |
11 May 2026, 08:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
08 May 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-08 15:16
Updated : 2026-05-15 16:15
NVD link : CVE-2026-43366
Mitre link : CVE-2026-43366
CVE.ORG link : CVE-2026-43366
JSON object : View
Products Affected
linux
- linux_kernel
CWE