CVE-2026-99230

In the Linux kernel, the following vulnerability has been resolved:

io uring/cmd: don't leave list poison in ->hash node

io uring cmd del cancelable() uses hlist del() to take a command off ->cancelable uring cmd, which leaves LIST POISON1/2 behind in ->hash node. Requests are recycled through the request cache without being reinitialised, and not every user of ->hash node sets it up before it is used:

If a vectored futex wait is woken while futex wait multiple setup() is still queueing the futexes, io futexv wait() doesn't add the request to ->futex list, and leaves the completion to the task work queued by the wake up. io futexv complete() ends in io futex complete(), whose hlist del init() is fine for a request that is unhashed, which is how all other users of the node leave it. If the request was a cancelable uring cmd in its previous life, e.g. a ublk FETCH REQ, it writes through LIST POISON2:

Oops: general protection fault, probably for non-canonical address KASAN: maybe wild-memory-access in range [0xdead000000000120-...] RIP: 0010:io futexv complete+0x219/0x420 Call Trace: tctx task work run+0x804/0x950 tctx task work+0x71/0xa0 task work run+0x118/0x200

Leave the node unhashed.