UBUNTU-CVE-2026-99203: Use After Free
In the Linux kernel, the following vulnerability has been resolved: pipe: preserve existing fasync readers on writer setup failure FSETFL and FIOASYNC decide whether to invoke ->fasync() before pipefasync() takes pipe->mutex. Two enables of one ORDWR FIFO can therefore both enter the callback. fasynchelper() allocates before checking for an existing entry. If the first enable installs both entries, a second enable can update the reader entry and then fail the allocation for the writer entry. The error path removes the pre-existing reader entry, clearing FASYNC while the writer entry remains registered. fput() then skips ->fasync(), so a later pipe notification can dereference the freed file or its fowner. An unprivileged memory-pressure reproducer triggers a KASAN slab-use-after-free in sendsigio() through this path. Keep the reader helper's result and undo the registration only if this call added it. The pipe mutex serializes changes to both lists, so a failed new registration still removes its reader, while a failed duplicate preserves the existing registrations and FASYNC. Successful duplicate enables continue to update fafd as before.
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
The affected path involves two asynchronous-I/O enable operations on a single O_RDWR FIFO, where both can enter the fasync callback before the pipe mutex is acquired. The failure scenario requires allocation failure while setting up the writer-side asynchronous notification entry after an existing reader entry has been updated.
Can an unprivileged local user trigger it?
Yes. The provided reproducer is described as unprivileged and uses memory pressure to cause the allocation failure needed for the vulnerable error path.
How might the issue appear during testing or diagnostics?
A KASAN-enabled system can report a slab use-after-free in send_sigio() after the stale writer-side registration causes a later pipe notification to dereference a freed file or f_owner.