Improper input validation in Linux kernel - CVE-2026-43366
Published: May 9, 2026
Vulnerability identifier: #VU130818
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-43366
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper state validation in the io_uring kernel buffer recycling logic when recycling a previously grabbed buffer. A local user can trigger recycling of a buffer after the target buffer list has changed type to cause a denial of service.
This can occur when the request is forced via io-wq.
How to mitigate CVE-2026-43366
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/439a6728ec4641ffad1ca796622c19bc525e570f
- https://git.kernel.org/stable/c/50ad880db3013c6fee0ef13781762a39e2e7ef83
- https://git.kernel.org/stable/c/97b57f69fee1b61b41acbf37e7720cac9d389fa4
- https://git.kernel.org/stable/c/a7b33671e418fca507feebd1d56e7f4952a4b25c
- https://git.kernel.org/stable/c/c2c185be5c85d37215397c8e8781abf0a69bec1f
- https://git.kernel.org/stable/c/f3fb54e7a8b4aadcc2836ee463eec8c88709b8aa