Is CVE-2026-99266 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-99266 being exploited in the wild.

How severe is CVE-2026-99266?

Informational severity, published 3 November 2026.

Which products and versions are affected?

Linux Kernel 5.14 and later (io_uring zcrx functionality).

Is there a fix for CVE-2026-99266?

Yes: fixed in Kernel versions patched via commit 51f4ee29bf0564e6ae7d3540693a9bc1dd2c8fd7 and 9bfb315e2d0907fbcaf5d0453dd6d873c9aa8d5b. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-99266 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-99266?

Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-99266: Linux kernel io_uring integer overflow in buffer offset calculation

CVE-2026-99266 · Severity: info · Published 2026-11-03

The Linux kernel's io_uring subsystem contains an integer overflow vulnerability in its zero-copy receive (zcrx) implementation. When processing network buffers larger than 4GB, the kernel incorrectly calculates buffer offsets, causing applications to read data from wrong memory locations and leak unreferenced buffers, potentially leading to data corruption or information disclosure.

Technologies: Linux Kernel. Vendors: Linux.

Quick answers

Is CVE-2026-99266 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-99266 being exploited in the wild.
How severe is CVE-2026-99266?: Informational severity, published 3 November 2026.
Which products and versions are affected?: Linux Kernel 5.14 and later (io_uring zcrx functionality).
Is there a fix for CVE-2026-99266?: Yes: fixed in Kernel versions patched via commit 51f4ee29bf0564e6ae7d3540693a9bc1dd2c8fd7 and 9bfb315e2d0907fbcaf5d0453dd6d873c9aa8d5b. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-99266 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-99266?: Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Kernel versions patched via commit 51f4ee29bf0564e6ae7d3540693a9bc1dd2c8fd7 and 9bfb315e2d0907fbcaf5d0453dd6d873c9aa8d5b

Technical details

The io_zcrx_queue_cqe() function performs a 32-bit shift operation on an unsigned int before widening to u64, causing overflow for buffer indices beyond 4GB. The fix casts net_iov_idx(niov) to u64 before the shift operation. This affects zero-copy receive operations on large memory areas (up to 1TB), accessible to local applications using io_uring with zcrx enabled.

Affected products

Linux Linux kernel 5.14 and later (io_uring zcrx functionality)

Timeline

2026-11-03: disclosed
2026-10-30: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.