---
id: CVE-2026-43366
title: 'io_uring/kbuf: check if target buffer list is still legacy on recycle'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  io_uring/kbuf: check if target buffer list is still legacy on recycle

  There's a gap between when the buffer was grabbed and when it
  potentially gets recycled, where if…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c7fb19428d67dd0a2a78a4f237af01d39c78dc5a <
    a7b33671e418fca507feebd1d56e7f4952a4b25c
  - >-
    Linux >= c7fb19428d67dd0a2a78a4f237af01d39c78dc5a <
    439a6728ec4641ffad1ca796622c19bc525e570f
  - >-
    Linux >= c7fb19428d67dd0a2a78a4f237af01d39c78dc5a <
    f3fb54e7a8b4aadcc2836ee463eec8c88709b8aa
  - >-
    Linux >= c7fb19428d67dd0a2a78a4f237af01d39c78dc5a <
    50ad880db3013c6fee0ef13781762a39e2e7ef83
  - >-
    Linux >= c7fb19428d67dd0a2a78a4f237af01d39c78dc5a <
    97b57f69fee1b61b41acbf37e7720cac9d389fa4
  - >-
    Linux >= c7fb19428d67dd0a2a78a4f237af01d39c78dc5a <
    c2c185be5c85d37215397c8e8781abf0a69bec1f
  - Linux 5.19
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:16:47.117231Z'
published: '2026-05-08'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:40.063Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43366'
references:
  - url: 'https://git.kernel.org/stable/c/a7b33671e418fca507feebd1d56e7f4952a4b25c'
  - url: 'https://git.kernel.org/stable/c/439a6728ec4641ffad1ca796622c19bc525e570f'
  - url: 'https://git.kernel.org/stable/c/f3fb54e7a8b4aadcc2836ee463eec8c88709b8aa'
  - url: 'https://git.kernel.org/stable/c/50ad880db3013c6fee0ef13781762a39e2e7ef83'
  - url: 'https://git.kernel.org/stable/c/97b57f69fee1b61b41acbf37e7720cac9d389fa4'
  - url: 'https://git.kernel.org/stable/c/c2c185be5c85d37215397c8e8781abf0a69bec1f'
tags:
  - cve.org
epss: 0.00176
epssPercentile: 0.06649
ingestedAt: '2026-10-16T17:24:46.694Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

io_uring/kbuf: check if target buffer list is still legacy on recycle

There's a gap between when the buffer was grabbed and when it
potentially gets recycled, where if the list is empty, someone could've
upgraded it to a ring provided type. This can happen if the request
is forced via io-wq. The legacy recycling is missing checking if the
buffer_list still exists, and if it's of the correct type. Add those
checks.

## Affected

- `Linux >= c7fb19428d67dd0a2a78a4f237af01d39c78dc5a < a7b33671e418fca507feebd1d56e7f4952a4b25c`
- `Linux >= c7fb19428d67dd0a2a78a4f237af01d39c78dc5a < 439a6728ec4641ffad1ca796622c19bc525e570f`
- `Linux >= c7fb19428d67dd0a2a78a4f237af01d39c78dc5a < f3fb54e7a8b4aadcc2836ee463eec8c88709b8aa`
- `Linux >= c7fb19428d67dd0a2a78a4f237af01d39c78dc5a < 50ad880db3013c6fee0ef13781762a39e2e7ef83`
- `Linux >= c7fb19428d67dd0a2a78a4f237af01d39c78dc5a < 97b57f69fee1b61b41acbf37e7720cac9d389fa4`
- `Linux >= c7fb19428d67dd0a2a78a4f237af01d39c78dc5a < c2c185be5c85d37215397c8e8781abf0a69bec1f`
- `Linux 5.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.