CVE-2026-43366

/* * Conceptual PoC for CVE-2026-43366 * Demonstrates io_uring setup with buffer registration and submission. * Triggering the specific race condition requires precise timing. */ #include <liburing.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #define BUFFER_SIZE 4096 int main() { struct io_uring ring; struct iovec iovs[1]; char buffer[BUFFER_SIZE]; int ret; // Initialize io_uring instance ret = io_uring_queue_init(8, &ring, 0); if (ret < 0) { perror("io_uring_queue_init"); return 1; } // Setup buffer memset(buffer, 0, BUFFER_SIZE); iovs[0].iov_base = buffer; iovs[0].iov_len = BUFFER_SIZE; // Register buffers (Legacy type) // Note: The vulnerability occurs during the transition/recycle of these lists ret = io_uring_register_buffers(&ring, iovs, 1); if (ret < 0) { perror("io_uring_register_buffers"); return 1; } printf("Buffers registered. Exploitation logic would target the recycling gap.\n"); // Cleanup io_uring_queue_exit(&ring); return 0; }

{"cve": {"id": "CVE-2026-43366", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-05-08T15:16:47.623", "lastModified": "2026-05-11T08:16:11.427", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/kbuf: check if target buffer list is still legacy on recycle\n\nThere's a gap between when the buffer was grabbed and when it\npotentially gets recycled, where if the list is empty, someone could've\nupgraded it to a ring provided type. This can happen if the request\nis forced via io-wq. The legacy recycling is missing checking if the\nbuffer_list still exists, and if it's of the correct type. Add those\nchecks."}], "metrics": {"cvssMetricV31": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "references": [{"url": "https://git.kernel.org/stable/c/439a6728ec4641ffad1ca796622c19bc525e570f", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/50ad880db3013c6fee0ef13781762a39e2e7ef83", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/97b57f69fee1b61b41acbf37e7720cac9d389fa4", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a7b33671e418fca507feebd1d56e7f4952a4b25c", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c2c185be5c85d37215397c8e8781abf0a69bec1f", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f3fb54e7a8b4aadcc2836ee463eec8c88709b8aa", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}}