Quick answers
- Is CVE-2026-99230 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-99230 being exploited in the wild.
- How severe is CVE-2026-99230?
- Informational severity, published 2 November 2026.
- Which products and versions are affected?
- Linux kernel affected versions not explicitly stated in advisory.
- Is there a fix for CVE-2026-99230?
- Yes: fixed in Addressed by changing hlist_del() to hlist_del_init() in io_uring/uring_cmd.c (commit 4c83e39f4d1944d7146fd06094f2c8053238d55c upstream). Until then: Update to a Linux kernel version that includes the fix to use hlist_del_init() instead of hlist_del() in the io_uring_cmd_del_cancelable() function. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-99230 attacked?
- It is attacked with local access, in an operating system.
- Am I affected by CVE-2026-99230?
- Check whether you run Linux kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Addressed by changing hlist_del() to hlist_del_init() in io_uring/uring_cmd.c (commit 4c83e39f4d1944d7146fd06094f2c8053238d55c upstream)
Update to a Linux kernel version that includes the fix to use hlist_del_init() instead of hlist_del() in the io_uring_cmd_del_cancelable() function.
Technical details
The vulnerability exists in io_uring_cmd_del_cancelable() which uses hlist_del() instead of hlist_del_init() when removing a cancelable uring_cmd from the cancelable_uring_cmd list. This leaves LIST_POISON values in the hash_node field. When requests are recycled through the cache, subsequent operations (such as vectored futex waits) that reuse the hash_node without reinitializing it will dereference the poison value, causing a general protection fault and kernel panic.
Affected products
- Linux kernel affected versions not explicitly stated in advisory
Timeline
- 2026-10-15: disclosed
- 2026-10-30: patched