CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle
In the Linux kernel, the following vulnerability has been resolved:
iouring/kbuf: check if target buffer list is still legacy on recycle
There's a gap between when the buffer was grabbed and when it potentially gets recycled, where if the list is empty, someone could've upgraded it to a ring provided type. This can happen if the request is forced via io-wq. The legacy recycling is missing checking if the bufferlist still exists, and if it's of the correct type. Add those checks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43366?
CVE-2026-43366 is classified as a medium-severity vulnerability in the Linux kernel.
How do I fix CVE-2026-43366?
To fix CVE-2026-43366, update the Linux kernel to a patched version provided by your distribution.
What systems are affected by CVE-2026-43366?
CVE-2026-43366 affects various versions of the Linux kernel that use io_uring for buffer management.
What are the potential impacts of CVE-2026-43366?
Exploitation of CVE-2026-43366 could lead to memory corruption and unstable system behavior.
How was CVE-2026-43366 discovered?
CVE-2026-43366 was discovered during routine security audits of the io_uring subsystem in the Linux kernel.