High 7.8Published May 8, 2026

CVE-2026-43366io_uring/kbuf: check if target buffer list is still legacy on recycle

Updated under an hour ago (Oct 26, 2026, 7:00 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: check if target buffer list is still legacy on recycle There's a gap between when the buffer was grabbed and when it potentially gets recycled, where if the list is empty, someone could've upgraded it to a ring provided type. This can happen if the request is forced via io-wq. The legacy recycling is missing checking if the buffer_list still exists, and if it's of the correct type. Add those checks.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-362
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from c7fb19428d67dd0a2a78a4f237af01d39c78dc5a before a7b33671e418fca507feebd1d56e7f4952a4b25c; from c7fb19428d67dd0a2a78a4f237af01d39c78dc5a before 439a6728ec4641ffad1ca796622c19bc525e570f; from c7fb19428d67dd0a2a78a4f237af01d39c78dc5a before f3fb54e7a8b4aadcc2836ee463eec8c88709b8aa; from c7fb19428d67dd0a2a78a4f237af01d39c78dc5a before 50ad880db3013c6fee0ef13781762a39e2e7ef83; from c7fb19428d67dd0a2a78a4f237af01d39c78dc5a before 97b57f69fee1b61b41acbf37e7720cac9d389fa4; from c7fb19428d67dd0a2a78a4f237af01d39c78dc5a before c2c185be5c85d37215397c8e8781abf0a69bec1f	CNA record
linux linux_kernel linux:linux_kernel	from 5.19 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.78; from 6.13 before 6.18.19; from 6.19 before 6.19.9; 7.0; 7.0; 7.0	NVD

References

References

https://git.kernel.org/stable/c/a7b33671e418fca507feebd1d56e7f4952a4b25c	patch
https://git.kernel.org/stable/c/439a6728ec4641ffad1ca796622c19bc525e570f	patch
https://git.kernel.org/stable/c/f3fb54e7a8b4aadcc2836ee463eec8c88709b8aa	patch
https://git.kernel.org/stable/c/50ad880db3013c6fee0ef13781762a39e2e7ef83	patch
https://git.kernel.org/stable/c/97b57f69fee1b61b41acbf37e7720cac9d389fa4	patch
https://git.kernel.org/stable/c/c2c185be5c85d37215397c8e8781abf0a69bec1f	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.