CVE-2026-99203: Linux Vulnerability (CVSS 7.8)

Description

In the Linux kernel, the following vulnerability has been resolved: pipe: preserve existing fasync readers on writer setup failure F_SETFL and FIOASYNC decide whether to invoke ->fasync() before pipe_fasync() takes pipe->mutex. Two enables of one O_RDWR FIFO can therefore both enter the callback. fasync_helper() allocates before checking for an existing entry. If the first enable installs both entries, a second enable can update the reader entry and then fail the allocation for the writer entry. The error path removes the pre-existing reader entry, clearing FASYNC while the writer entry remains registered. __fput() then skips ->fasync(), so a later pipe notification can dereference the freed file or its f_owner. An unprivileged memory-pressure reproducer triggers a KASAN slab-use-after-free in send_sigio() through this path. Keep the reader helper's result and undo the registration only if this call added it. The pipe mutex serializes changes to both lists, so a failed new registration still removes its reader, while a failed duplicate preserves the existing registrations and FASYNC. Successful duplicate enables continue to update fa_fd as before.

Metrics

CVSS 3.1

7.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

0.16%

5.2th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

Vendor	Product	Versions
Linux	Linux	>= 76398425bb06b07cc3a3b1ce169c67dc9d6874ed, < 6041bcd185d4df051490fe166e64feae6c3b8291; >= 76398425bb06b07cc3a3b1ce169c67dc9d6874ed, < 7cdbfa22a7e270b155ddb958b1583a999c0c8abb; >= 76398425bb06b07cc3a3b1ce169c67dc9d6874ed, < 22c7f57b0c0b0b8e19cfb41a1bd85f55715ad386; >= 76398425bb06b07cc3a3b1ce169c67dc9d6874ed, < 94be790dd6fbe0912f35bb711bea8ef3687eaca9; >= 76398425bb06b07cc3a3b1ce169c67dc9d6874ed, < 9b0aa2a1d8df51f3dcb363c3a2d9531098e88dc6; >= 76398425bb06b07cc3a3b1ce169c67dc9d6874ed, < 4c42ce499ce4b1c787e61082e3b13df4f30c4eaa; >= 76398425bb06b07cc3a3b1ce169c67dc9d6874ed, < 2259809e5b7043c4ba20af7b14ba3e471cf55521; >= 76398425bb06b07cc3a3b1ce169c67dc9d6874ed, < 40bb03d3ea6f6a915218508819ecc4d7a7fa260d
Linux	Linux	2.6.30

References

Timeline

Published: Oct 28, 2026
Last Modified: Oct 31, 2026
Status: Received

Frequently Asked Questions

What is CVE-2026-99203?

In the Linux kernel, the following vulnerability has been resolved: pipe: preserve existing fasync readers on writer setup failure F_SETFL and FIOASYNC decide whether to invoke ->fasync() before pipe_fasync() takes pipe->mutex. Two enables of one O_RDWR FIFO can therefore both enter the callback. fasync_helper() allocates before checking for an existing entry. If the first enable installs both entries, a second enable can update the reader entry and then fail the allocation for the writer entry. The error path removes the pre-existing reader entry, clearing FASYNC while the writer entry remains registered. __fput() then skips ->fasync(), so a later pipe notification can dereference the freed file or its f_owner. An unprivileged memory-pressure reproducer triggers a KASAN slab-use-after-free in send_sigio() through this path. Keep the reader helper's result and undo the registration only if this call added it. The pipe mutex serializes changes to both lists, so a failed new registration still removes its reader, while a failed duplicate preserves the existing registrations and FASYNC. Successful duplicate enables continue to update fa_fd as before.

How severe is CVE-2026-99203?

CVE-2026-99203 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.16% probability of exploitation in the next 30 days.

How do I fix CVE-2026-99203?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →