DEBIAN-CVE-2026-99265

    Dashboard / Vulnerabilities / DEBIAN-CVE-2026-99265

    DEBIAN-CVE-2026-99265

    Published: 3 Nov 2026Last Modified: 4 Nov 2026
    Upstream:
    CVE-2026-99265

    Summary:

    Details: In the Linux kernel, the following vulnerability has been resolved: io_uring/openclose: keep the lock in io_pipe_fixed() io_pipe_fixed() installs both ends of the pipe in the fixed file table, drops ->uring_lock, and copies the slot numbers to the application. If that faults, it takes the lock again and removes whatever is in these slots. If the request is run by io-wq the lock really is dropped in between, and the slots are visible to everybody else. By the time the error path gets to them, they may have been closed and reused, by IORING_OP_CLOSE and a direct open or accept, or by IORING_REGISTER_FILES_UPDATE. Then a file is removed from the table that has nothing to do with the failed request. Do the copy with the lock held. Faulting in user memory under ->uring_lock is fine, the registration paths do it all the time.

    References: https://security-tracker.debian.org/tracker/CVE-2026-99265

    Affected packages

    Package

    Name: linux

    Purl: pkg:deb/debian/linux?arch=source&distro=forky

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    6.12.100-1
    6.12.101-1
    6.12.105-1
    6.12.107-1
    6.12.111-1
    6.12.113-1
    6.12.115-1
    6.12.115-2
    6.12.38-1
    6.12.41-1
    6.12.43-1
    6.12.43-1~bpo12+1
    6.12.48-1
    6.12.57-1
    6.12.57-1~bpo12+1
    6.12.63-1
    6.12.63-1~bpo12+1
    6.12.69-1
    6.12.69-1~bpo12+1
    6.12.73-1
    6.12.73-1~bpo12+1
    6.12.74-1
    6.12.74-2
    6.12.74-2~bpo12+1
    6.12.85-1
    6.12.85-1~bpo12+1
    6.12.86-1
    6.12.86-1~bpo12+1
    6.12.88-1
    6.12.88-1~bpo12+1
    6.12.90-1
    6.12.90-1~bpo12+1
    6.12.90-2
    6.12.90-2~bpo12+1
    6.12.94-1
    6.12.94-1~bpo12+1
    6.12.95-1
    6.12.95-1~bpo12+1
    6.12.96-1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    DEBIAN-CVE-2026-99265 | CVE-DB