{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99096", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.390Z", "datePublished": "2026-10-26T14:52:03.236Z", "dateUpdated": "2026-10-26T14:52:03.236Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-26T14:52:03.236Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/register: don't exempt disabled rings from task restrictions\n\nA ring created with IORING_SETUP_R_DISABLED is exempt from its register\nrestrictions until it is enabled. This lets the creator register the\nrestrictions and then enable the ring with IORING_REGISTER_ENABLE_RINGS,\nwhether or not that opcode is in the allowed set.\n\nSince commit ed82f35b926b (\"io_uring: allow registration of per-task\nrestrictions\"), a ring also inherits restrictions from the task that\ncreates it, and the same exemption applies to those. A task whose\nregister opcodes are restricted can therefore create a disabled ring,\nissue any register opcode on it, and then enable it.\n\nMark rings whose restrictions were inherited from the task, and keep\nchecking register opcodes for them while the ring is disabled. Enabling\nsuch a ring now requires IORING_REGISTER_ENABLE_RINGS to be in the\ntask's allowed set. Per-ring restrictions registered on a disabled ring\nwork as before.\n\n[axboe: amend with inheritance flag fixup]"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/io_uring_types.h", "io_uring/io_uring.c", "io_uring/register.c"], "versions": [{"version": "ed82f35b926b2e505c14b7006473614b8f58b4f4", "lessThan": "f55c240192ded562386de843bfa067671d2731d5", "status": "affected", "versionType": "git"}, {"version": "ed82f35b926b2e505c14b7006473614b8f58b4f4", "lessThan": "6da8f402e362b2f546e2efb7167fc9597aef6faf", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/io_uring_types.h", "io_uring/io_uring.c", "io_uring/register.c"], "versions": [{"version": "7.0", "status": "affected"}, {"version": "0", "lessThan": "7.0", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f55c240192ded562386de843bfa067671d2731d5"}, {"url": "https://git.kernel.org/stable/c/6da8f402e362b2f546e2efb7167fc9597aef6faf"}], "title": "io_uring/register: don't exempt disabled rings from task restrictions", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/linux/io_uring_types.h", "io_uring/io_uring.c", "io_uring/register.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f55c240192ded562386de843bfa067671d2731d5", "status": "affected", "version": "ed82f35b926b2e505c14b7006473614b8f58b4f4", "versionType": "git"}, {"lessThan": "6da8f402e362b2f546e2efb7167fc9597aef6faf", "status": "affected", "version": "ed82f35b926b2e505c14b7006473614b8f58b4f4", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/linux/io_uring_types.h", "io_uring/io_uring.c", "io_uring/register.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.0"}, {"lessThan": "7.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/register: don't exempt disabled rings from task restrictions\n\nA ring created with IORING_SETUP_R_DISABLED is exempt from its register\nrestrictions until it is enabled. This lets the creator register the\nrestrictions and then enable the ring with IORING_REGISTER_ENABLE_RINGS,\nwhether or not that opcode is in the allowed set.\n\nSince commit ed82f35b926b (\"io_uring: allow registration of per-task\nrestrictions\"), a ring also inherits restrictions from the task that\ncreates it, and the same exemption applies to those. A task whose\nregister opcodes are restricted can therefore create a disabled ring,\nissue any register opcode on it, and then enable it.\n\nMark rings whose restrictions were inherited from the task, and keep\nchecking register opcodes for them while the ring is disabled. Enabling\nsuch a ring now requires IORING_REGISTER_ENABLE_RINGS to be in the\ntask's allowed set. Per-ring restrictions registered on a disabled ring\nwork as before.\n\n[axboe: amend with inheritance flag fixup]"}], "id": "CVE-2026-99096", "lastModified": "2026-10-26T15:16:48.633", "metrics": {}, "published": "2026-10-26T15:16:48.633", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6da8f402e362b2f546e2efb7167fc9597aef6faf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f55c240192ded562386de843bfa067671d2731d5"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ed82f35b926b2e505c14b7006473614b8f58b4f4,f55c240192ded562386de843bfa067671d2731d5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ed82f35b926b2e505c14b7006473614b8f58b4f4,6da8f402e362b2f546e2efb7167fc9597aef6faf)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ed82f35b926b2e505c14b7006473614b8f58b4f4,f55c240192ded562386de843bfa067671d2731d5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ed82f35b926b2e505c14b7006473614b8f58b4f4,6da8f402e362b2f546e2efb7167fc9597aef6faf)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-26T16:45:14.917793+00:00", "updated": "2026-10-26T17:15:06.747465+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-284"]}