Linux kernel io_uring: legacy buffer recycle does not re-check that the buffer list still exists or is legacy

Impact

Between grabbing a provided buffer and recycling it, another thread can free the buffer list or upgrade it to the ring-provided type - a window that opens when a request is punted to io-wq. The legacy recycle path did not re-check that the buffer_list still existed or was still of the legacy type, so it operates on freed or type-confused state. io_uring is unprivileged by default and is the hot path for modern storage and inference I/O, so on a shared GPU node the reachable attacker is an ordinary tenant process; NVD rates it 7.8 local with high confidentiality, integrity and availability impact, i.e. plausible container escape to host root on a node you cannot drain cheaply because its GPUs are mid-job. Five stable branches carry backports, so this is not confined to the newest kernels.

Who can reach it

Local, any authenticated user or container process that can call io_uring_setup() and register provided buffers - no capabilities required unless io_uring has been restricted. Winning the race needs a request forced through io-wq, which userspace can arrange.

What to do

Patch to a stable kernel with the added checks and reboot; io_uring is built into the kernel, so there is no restart-the-daemon option. If a reboot window is far off, io_uring_disabled=2 (or a seccomp filter blocking io_uring_setup) shuts the interface for tenant workloads - verify first that your runtime and storage stack do not depend on it, since several do.

References

Related entries

• Linux kernel (net/rds): When pinning user pages for a zerocopy RDS send fails, the pages are released but theCVE-2026-43494 · Linux kernel (net/rds)High
• Linux kernel (net/rds): A zerocopy RDS send that fails after pinning user pages but before the message reaches theCVE-2026-43502 · Linux kernel (net/rds)High
• Linux kernel BPF: negative CO-RE accessor index causes an out-of-bounds read and deterministic kernel crashCVE-2026-45839 · Linux kernel BPF verifier (bpf_core_parse_spec CO-RE accessor parsing)High
• Linux kernel (drivers/iommu/intel): VT-d publishes the address of a freshly allocated PASID table into the PASIDCVE-2026-45862 · Linux kernel (drivers/iommu/intel)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-45878 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel (drivers/iommu/intel): The 512-bit VT-d PASID entry is zeroed all at once while still marked present, andCVE-2026-45894 · Linux kernel (drivers/iommu/intel)High