CVE Explorer

CVE-2026-43366

In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: check if target buffer list is still legacy on recycle There's a gap between when the buffer was grabbed and when it potentially gets recycled, where if the list is empty, someone could've upgraded it to a ring provided type. This can happen if the request is forced via io-wq. The legacy recycling is missing checking if the buffer_list still exists, and if it's of the correct type. Add those checks.

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:48b13fcdf450c6f3a3662dbcea13a9c76de9bde1f6132dc9c8b77ef4a8b157f2

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"affected","product":"Linux","programFiles":["io_uring/kbuf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.19"},{"lessThan":"5.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.167","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.130","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual"…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:1dbf89e68524cd38a25aaa39e75a1658e428b52256ad622ec1f43210ab1f439b · sha256:6bfd45a02fba40a2… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Linux","programFiles":["io_uring/kbuf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a7b33671e418fca507feebd1d56e7f4952a4b25c","status":"affected","version":"c7fb19428d67dd0a2a78a4f237af01d39c78dc5a","versionType":"git"},{"lessThan":"439a6728ec4641ffad1ca796622c19bc525e570f","status":"affected","version":"c7fb19428d67dd0a2a78a4f237af01d39c78dc5a","versionType":"git"},{"lessThan":"f3fb54e7a8b4aadcc2836ee463eec8c88709b8aa","status":"affected","version":"c7fb19428d67dd0a2a78a4f237af01…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:1dbf89e68524cd38a25aaa39e75a1658e428b52256ad622ec1f43210ab1f439b · sha256:6bfd45a02fba40a2… · /containers/cna/affected/0

Affected products and versions

2 source assertions

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:1dbf89e68524cd38a25aaa39e75a1658e428b52256ad622ec1f43210ab1f439b · sha256:6bfd45a02fba40a2… · /containers/cna/affected/1

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:1dbf89e68524cd38a25aaa39e75a1658e428b52256ad622ec1f43210ab1f439b · sha256:6bfd45a02fba40a2… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:1dbf89e68524cd38a25aaa39e75a1658e428b52256ad622ec1f43210ab1f439b · sha256:6bfd45a02fba40a2… · /containers/cna/metrics/0/cvssV3_1

Source references

6 source assertions

{"url":"https://git.kernel.org/stable/c/439a6728ec4641ffad1ca796622c19bc525e570f"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:1dbf89e68524cd38a25aaa39e75a1658e428b52256ad622ec1f43210ab1f439b · sha256:6bfd45a02fba40a2… · /containers/cna/references/1

{"url":"https://git.kernel.org/stable/c/50ad880db3013c6fee0ef13781762a39e2e7ef83"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:1dbf89e68524cd38a25aaa39e75a1658e428b52256ad622ec1f43210ab1f439b · sha256:6bfd45a02fba40a2… · /containers/cna/references/3

{"url":"https://git.kernel.org/stable/c/97b57f69fee1b61b41acbf37e7720cac9d389fa4"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:1dbf89e68524cd38a25aaa39e75a1658e428b52256ad622ec1f43210ab1f439b · sha256:6bfd45a02fba40a2… · /containers/cna/references/4

{"url":"https://git.kernel.org/stable/c/a7b33671e418fca507feebd1d56e7f4952a4b25c"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:1dbf89e68524cd38a25aaa39e75a1658e428b52256ad622ec1f43210ab1f439b · sha256:6bfd45a02fba40a2… · /containers/cna/references/0

{"url":"https://git.kernel.org/stable/c/c2c185be5c85d37215397c8e8781abf0a69bec1f"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:1dbf89e68524cd38a25aaa39e75a1658e428b52256ad622ec1f43210ab1f439b · sha256:6bfd45a02fba40a2… · /containers/cna/references/5

{"url":"https://git.kernel.org/stable/c/f3fb54e7a8b4aadcc2836ee463eec8c88709b8aa"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:1dbf89e68524cd38a25aaa39e75a1658e428b52256ad622ec1f43210ab1f439b · sha256:6bfd45a02fba40a2… · /containers/cna/references/2

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer