{"id":"CVE-2026-43366","title":"io_uring/kbuf: check if target buffer list is still legacy on recycle","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/kbuf: check if target buffer list is still legacy on recycle\n\nThere's a gap between when the buffer was grabbed and when it\npotentially gets recycled, where if…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= c7fb19428d67dd0a2a78a4f237af01d39c78dc5a < a7b33671e418fca507feebd1d56e7f4952a4b25c","Linux >= c7fb19428d67dd0a2a78a4f237af01d39c78dc5a < 439a6728ec4641ffad1ca796622c19bc525e570f","Linux >= c7fb19428d67dd0a2a78a4f237af01d39c78dc5a < f3fb54e7a8b4aadcc2836ee463eec8c88709b8aa","Linux >= c7fb19428d67dd0a2a78a4f237af01d39c78dc5a < 50ad880db3013c6fee0ef13781762a39e2e7ef83","Linux >= c7fb19428d67dd0a2a78a4f237af01d39c78dc5a < 97b57f69fee1b61b41acbf37e7720cac9d389fa4","Linux >= c7fb19428d67dd0a2a78a4f237af01d39c78dc5a < c2c185be5c85d37215397c8e8781abf0a69bec1f","Linux 5.19"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:16:47.117231Z"},"published":"2026-05-08","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:20:40.063Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43366","references":[{"url":"https://git.kernel.org/stable/c/a7b33671e418fca507feebd1d56e7f4952a4b25c"},{"url":"https://git.kernel.org/stable/c/439a6728ec4641ffad1ca796622c19bc525e570f"},{"url":"https://git.kernel.org/stable/c/f3fb54e7a8b4aadcc2836ee463eec8c88709b8aa"},{"url":"https://git.kernel.org/stable/c/50ad880db3013c6fee0ef13781762a39e2e7ef83"},{"url":"https://git.kernel.org/stable/c/97b57f69fee1b61b41acbf37e7720cac9d389fa4"},{"url":"https://git.kernel.org/stable/c/c2c185be5c85d37215397c8e8781abf0a69bec1f"}],"tags":["cve.org"],"epss":0.00176,"epssPercentile":0.06642,"ingestedAt":"2026-10-16T17:24:46.694Z","slug":"CVE-2026-43366","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/kbuf: check if target buffer list is still legacy on recycle\n\nThere's a gap between when the buffer was grabbed and when it\npotentially gets recycled, where if the list is empty, someone could've\nupgraded it to a ring provided type. This can happen if the request\nis forced via io-wq. The legacy recycling is missing checking if the\nbuffer_list still exists, and if it's of the correct type. Add those\nchecks.\n\n## Affected\n\n- `Linux >= c7fb19428d67dd0a2a78a4f237af01d39c78dc5a < a7b33671e418fca507feebd1d56e7f4952a4b25c`\n- `Linux >= c7fb19428d67dd0a2a78a4f237af01d39c78dc5a < 439a6728ec4641ffad1ca796622c19bc525e570f`\n- `Linux >= c7fb19428d67dd0a2a78a4f237af01d39c78dc5a < f3fb54e7a8b4aadcc2836ee463eec8c88709b8aa`\n- `Linux >= c7fb19428d67dd0a2a78a4f237af01d39c78dc5a < 50ad880db3013c6fee0ef13781762a39e2e7ef83`\n- `Linux >= c7fb19428d67dd0a2a78a4f237af01d39c78dc5a < 97b57f69fee1b61b41acbf37e7720cac9d389fa4`\n- `Linux >= c7fb19428d67dd0a2a78a4f237af01d39c78dc5a < c2c185be5c85d37215397c8e8781abf0a69bec1f`\n- `Linux 5.19`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}