{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-99203","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-09-25T10:25:14.400Z","datePublished":"2026-10-28T10:35:57.589Z","dateUpdated":"2026-10-31T12:45:00.735Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-10-31T12:45:00.735Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npipe: preserve existing fasync readers on writer setup failure\n\nF_SETFL and FIOASYNC decide whether to invoke ->fasync() before\npipe_fasync() takes pipe->mutex. Two enables of one O_RDWR FIFO can\ntherefore both enter the callback.\n\nfasync_helper() allocates before checking for an existing entry. If the\nfirst enable installs both entries, a second enable can update the\nreader entry and then fail the allocation for the writer entry. The\nerror path removes the pre-existing reader entry, clearing FASYNC while\nthe writer entry remains registered. __fput() then skips ->fasync(), so a\nlater pipe notification can dereference the freed file or its f_owner.\nAn unprivileged memory-pressure reproducer triggers a KASAN\nslab-use-after-free in send_sigio() through this path.\n\nKeep the reader helper's result and undo the registration only if this\ncall added it. The pipe mutex serializes changes to both lists, so a\nfailed new registration still removes its reader, while a failed\nduplicate preserves the existing registrations and FASYNC. Successful\nduplicate enables continue to update fa_fd as before."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - An attacker reaches the patched pipe_fasync() only through local fcntl(fd,F_SETFL,...O_ASYNC) or ioctl(fd,FIOASYNC,...) on an O_RDWR FIFO; no protocol packet supplies the triggering state.\nAC:L - Two attacker threads control both enable calls and can retry the filp->f_flags race; fasync_cache is SLAB_ACCOUNT, and the fix reports an unprivileged memory-pressure reproducer that makes the duplicate writer allocation fail.\nPR:L - mknodat(...,S_IFIFO,...) reaches vfs_mknod() without CAP_MKNOD because that check covers only block and character nodes, and neither F_SETFL nor FIOASYNC requires a capability on the caller's FIFO descriptor.\nUI:N - The attacker creates and opens the FIFO, races asynchronous enablement, closes the stale file, and reads the retained FIFO to invoke anon_pipe_read()->kill_fasync(); no victim action is needed.\nS:U - The stale pipe fasync entry corrupts objects used by kill_fasync_rcu() and send_sigio() inside the same kernel security authority; this is ordinary local kernel privilege escalation, not a VM or IOMMU boundary crossing.\nC:H - kill_fasync_rcu() reads fa_file->f_owner after both the file and owner can have been freed, and send_sigio() follows reclaimed fown->pid and credential fields; reclaiming these slabs provides a fake-object arbitrary-read primitive.\nI:H - send_sigio() acquires fown->lock and acts on fown->pid through the freed, reclaimable owner, writing lock and signal/task state through attacker-shaped pointers; this UAF is exploitable memory corruption rather than a read-only stale access.\nA:H - The fix reports a reproduced KASAN slab-use-after-free in send_sigio(); the stale lock and pid dereferences during anon_pipe_read() notification can oops, panic, or hang the kernel."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/pipe.c"],"versions":[{"version":"76398425bb06b07cc3a3b1ce169c67dc9d6874ed","lessThan":"6041bcd185d4df051490fe166e64feae6c3b8291","status":"affected","versionType":"git"},{"version":"76398425bb06b07cc3a3b1ce169c67dc9d6874ed","lessThan":"7cdbfa22a7e270b155ddb958b1583a999c0c8abb","status":"affected","versionType":"git"},{"version":"76398425bb06b07cc3a3b1ce169c67dc9d6874ed","lessThan":"22c7f57b0c0b0b8e19cfb41a1bd85f55715ad386","status":"affected","versionType":"git"},{"version":"76398425bb06b07cc3a3b1ce169c67dc9d6874ed","lessThan":"94be790dd6fbe0912f35bb711bea8ef3687eaca9","status":"affected","versionType":"git"},{"version":"76398425bb06b07cc3a3b1ce169c67dc9d6874ed","lessThan":"9b0aa2a1d8df51f3dcb363c3a2d9531098e88dc6","status":"affected","versionType":"git"},{"version":"76398425bb06b07cc3a3b1ce169c67dc9d6874ed","lessThan":"4c42ce499ce4b1c787e61082e3b13df4f30c4eaa","status":"affected","versionType":"git"},{"version":"76398425bb06b07cc3a3b1ce169c67dc9d6874ed","lessThan":"2259809e5b7043c4ba20af7b14ba3e471cf55521","status":"affected","versionType":"git"},{"version":"76398425bb06b07cc3a3b1ce169c67dc9d6874ed","lessThan":"40bb03d3ea6f6a915218508819ecc4d7a7fa260d","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/pipe.c"],"versions":[{"version":"2.6.30","status":"affected"},{"version":"0","lessThan":"2.6.30","status":"unaffected","versionType":"semver"},{"version":"5.10.273","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.224","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.59","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.13","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.30","versionEndExcluding":"5.10.273"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.30","versionEndExcluding":"5.15.224"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.30","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.30","versionEndExcluding":"6.6.161"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.30","versionEndExcluding":"6.12.115"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.30","versionEndExcluding":"6.18.59"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.30","versionEndExcluding":"7.2.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.30","versionEndExcluding":"7.3"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/6041bcd185d4df051490fe166e64feae6c3b8291"},{"url":"https://git.kernel.org/stable/c/7cdbfa22a7e270b155ddb958b1583a999c0c8abb"},{"url":"https://git.kernel.org/stable/c/22c7f57b0c0b0b8e19cfb41a1bd85f55715ad386"},{"url":"https://git.kernel.org/stable/c/94be790dd6fbe0912f35bb711bea8ef3687eaca9"},{"url":"https://git.kernel.org/stable/c/9b0aa2a1d8df51f3dcb363c3a2d9531098e88dc6"},{"url":"https://git.kernel.org/stable/c/4c42ce499ce4b1c787e61082e3b13df4f30c4eaa"},{"url":"https://git.kernel.org/stable/c/2259809e5b7043c4ba20af7b14ba3e471cf55521"},{"url":"https://git.kernel.org/stable/c/40bb03d3ea6f6a915218508819ecc4d7a7fa260d"}],"title":"pipe: preserve existing fasync readers on writer setup failure","x_generator":{"engine":"bippy-1.2.0"}}}}