UBUNTU-CVE-2026-99265: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: iouring/openclose: keep the lock in iopipefixed() iopipefixed() installs both ends of the pipe in the fixed file table, drops ->uringlock, and copies the slot numbers to the application. If that faults, it takes the lock again and removes whatever is in these slots. If the request is run by io-wq the lock really is dropped in between, and the slots are visible to everybody else. By the time the error path gets to them, they may have been closed and reused, by IORINGOPCLOSE and a direct open or accept, or by IORINGREGISTERFILESUPDATE. Then a file is removed from the table that has nothing to do with the failed request. Do the copy with the lock held. Faulting in user memory under ->uringlock is fine, the registration paths do it all the time.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In io_pipe_fixed(), keep ->uring_lock held while copying the pipe slot numbers to the application; do not drop the lock before the copy.
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
The vulnerable path involves io_pipe_fixed() installing pipe ends in an io_uring fixed-file table, followed by a failure while copying the slot numbers to the application. The race is relevant when the request runs through io-wq, allowing other operations to close, reopen, accept, or update those fixed-file slots before cleanup runs.
What could happen if the race is triggered?
The error cleanup may remove a file from the fixed-file table that is unrelated to the failed pipe request. This can occur if the original slots were closed and reused by IORING_OP_CLOSE, a direct open or accept, or IORING_REGISTER_FILES_UPDATE.
Which Ubuntu packages are listed as affected?
The listed software includes ubuntu/linux, ubuntu/linux-fips, ubuntu/linux-aws, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-oracle, ubuntu/linux-aws-fips, and ubuntu/linux-azure-fips.