CVE-2026-99231

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12.115 Linux kernel versions prior to 6.18.60

Description A use-after-free issue exists in the io uring waitid handling. The io waitid wait() function clears the ->head variable before establishing ownership of the request by incrementing ->refs. This creates a race condition where another process can complete the request and free the memory while the wake-up handler is still accessing it. This can lead to kernel memory corruption, potentially resulting in a system crash or privilege escalation.

Recommendations Update to version 6.12.115. Update to version 6.18.60.