SB2026102974 - Use-after-free in Linux kernel fs

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-99203)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Linux kernel pipe_fasync() function when concurrent attempts to enable asynchronous notifications on an O_RDWR FIFO encounter a writer-entry allocation failure. A local user can trigger concurrent enables under memory pressure, causing an existing reader registration to be removed while the writer registration remains active, to leave a stale reference that may crash the kernel during a later pipe notification.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2259809e5b7043c4ba20af7b14ba3e471cf55521
• https://git.kernel.org/stable/c/40bb03d3ea6f6a915218508819ecc4d7a7fa260d
• https://git.kernel.org/stable/c/4c42ce499ce4b1c787e61082e3b13df4f30c4eaa