CVE-2026-99264: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-99264 is a buffer handling vulnerability in the Linux kernel's io_uring network subsystem, specifically in the io_uring/net component. The flaw was introduced by commit 41b70df5b38b ("io_uring/net: commit partial buffers on retry") and causes the kernel to reuse receive buffer memory that is still being written to by a retried request, leading to data corruption and unintended data disclosure. Affected Linux kernel versions include 6.6.103–6.7, 6.12.44–6.12.115, 6.15.11–6.16, 6.16.2–6.17, and 6.17. It was published on November 3, 2026, with a patch available on the same date. Feedly estimates the severity as Medium (GitHub Advisory).

The root cause is improper buffer lifecycle management (related to CWE-362, concurrent execution with shared resource) in the io_uring network receive path. When a partial receive is retried, commit 41b70df5b38b commits only the bytes received so far, but for buffer rings using IOU_PBUF_RING_INC or multi-buffer bundles, the remaining unmapped buffer memory stays at the head of the ring and is not fully committed. A subsequent receive request using the same buffer group can be handed this still-in-use memory, causing whichever request completes last to overwrite the other's data. Additionally, data filled during the retry is never committed at all, so the kernel may re-issue that buffer to the application with incorrect completion queue entry (CQE) accounting. The fix changes the behavior so that instead of retrying, the request completes with what it has received, returning a short count (GitHub Advisory).

Successful exploitation results in data corruption and unintended disclosure of receive buffer contents between concurrent io_uring receive operations sharing the same buffer group. A local user with access to io_uring APIs can cause received network data to be overwritten or exposed to unintended recipients within the same system, compromising data confidentiality and integrity. Availability impact is limited, but the incorrect CQE accounting can cause application-level logic errors. There is no evidence of privilege escalation or remote code execution potential from this vulnerability (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The vulnerability requires local access to io_uring APIs and the ability to issue concurrent receive operations on the same buffer group, limiting the attack surface to local users or processes. No threat actor attribution has been reported, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. EPSS score data is not yet available for this CVE (GitHub Advisory).

Update the Linux kernel to a patched version: 6.12.115 or later (for the 6.12.x branch), or any version incorporating the fixes at commits 21cb1770a56a, fc8506eea449, or 97b8dc36ba3c. As an interim workaround, restrict access to io_uring APIs to trusted users only (e.g., via seccomp filters or sysctl kernel.io_uring_disabled=1 where supported). Distributions shipping affected kernel versions should apply vendor-provided kernel updates promptly (GitHub Advisory, Kernel Patch 1, Kernel Patch 2).