CVE-2026-43366 Overview
CVE-2026-43366 is a Linux kernel vulnerability in the io_uring/kbuf subsystem. The flaw stems from a race window between when a buffer is grabbed and when it is potentially recycled. If the buffer list becomes empty during this window, another thread can upgrade it from a legacy list to a ring-provided buffer type. The legacy recycling path fails to verify that the buffer_list still exists and remains the correct type before releasing the buffer back. This condition can be triggered when a request is forced through io-wq. Local attackers with low privileges can leverage the type confusion to corrupt kernel memory.
Critical Impact
Local low-privileged users can trigger type confusion in the io_uring buffer recycling path, leading to potential kernel memory corruption and privilege escalation.
Affected Products
- Linux kernel 7.0-rc1
- Linux kernel 7.0-rc2
- Linux kernel 7.0-rc3
Discovery Timeline
- 2026-05-08 - CVE-2026-43366 published to NVD
- 2026-05-15 - Last updated in NVD database
Technical Details for CVE-2026-43366
Vulnerability Analysis
The vulnerability resides in the io_uring kernel buffer (kbuf) recycling logic. io_uring supports two buffer provisioning models: legacy provided buffers maintained as a list, and ring-mapped provided buffers. The kernel tracks which model a buffer_list uses and applies different recycling paths for each.
A race condition occurs between buffer acquisition and recycling. After a buffer is grabbed for a request, the legacy recycling path returns it to the originating list. If the list becomes empty during execution, a concurrent thread can destroy that list and register a new ring-provided list under the same identifier. When the original request later attempts to recycle into what it believes is a legacy list, it operates on a list that has changed type [CWE-843].
This condition is reachable when requests are deferred to the io-wq worker thread pool, which widens the timing window between buffer grab and recycle.
Root Cause
The legacy buffer recycling path does not revalidate the target buffer_list after re-acquiring it. Specifically, it omits checks confirming that the list still exists and that its provisioning type has not been upgraded to a ring-provided list. Without these checks, structures interpreted as one type are accessed using the layout of the other.
Attack Vector
Exploitation requires local access and the ability to issue io_uring system calls. An attacker submits requests configured to use legacy provided buffers, forces execution through io-wq, and races to upgrade the same buffer group to a ring-provided type before recycling completes. Successful exploitation yields kernel memory corruption with potential for privilege escalation.
No public proof-of-concept code is currently available for this vulnerability. Technical details can be reviewed in the upstream patches referenced in Linux Kernel Commit c2c185b.
Detection Methods for CVE-2026-43366
Indicators of Compromise
- Unexpected kernel oops or panic entries in dmesg referencing io_uring, io_kbuf, or io_recycle_buffer.
- Processes invoking io_uring_setup, io_uring_register, and IORING_OP_PROVIDE_BUFFERS operations from unprivileged contexts.
- Kernel slab corruption warnings from KASAN or SLUB_DEBUG mentioning io_buffer structures.
Detection Strategies
- Monitor for processes that combine heavy io_uring usage with rapid buffer group registration and unregistration cycles.
- Audit syscall telemetry for unprivileged users performing io_uring_register with IORING_REGISTER_PBUF_RING shortly after IORING_OP_PROVIDE_BUFFERS.
- Correlate kernel ring-buffer warnings with workload owners to identify abnormal io-wq worker activity.
Monitoring Recommendations
- Enable kernel auditd rules covering the io_uring_setup and io_uring_register syscalls.
- Forward dmesg and journald kernel logs to a centralized analytics platform for anomaly review.
- Track kernel version inventory to identify hosts still running affected 7.0-rc builds.
How to Mitigate CVE-2026-43366
Immediate Actions Required
- Update affected hosts to a Linux kernel version that includes the upstream fix referenced in the kernel.org commits.
- Restrict io_uring access for untrusted local users by setting kernel.io_uring_disabled=2 via sysctl where workloads permit.
- Inventory development and test systems running 7.0 release-candidate kernels and prioritize them for patching.
Patch Information
The fix adds checks in the legacy recycling path to verify that the target buffer_list still exists and is still of legacy type before recycling. Patch commits are available at Linux Kernel Commit 439a672, Linux Kernel Commit 50ad880, Linux Kernel Commit 97b57f6, Linux Kernel Commit a7b3367, Linux Kernel Commit c2c185b, and Linux Kernel Commit f3fb54e.
Workarounds
- Disable io_uring for unprivileged users using the io_uring_disabled sysctl when applications do not require it.
- Apply seccomp filters that block io_uring_setup and io_uring_register syscalls in container and sandbox profiles.
- Limit local shell access on multi-tenant systems until kernels are patched.
# Disable io_uring for unprivileged users system-wide
echo 'kernel.io_uring_disabled = 2' | sudo tee /etc/sysctl.d/99-io_uring.conf
sudo sysctl --system
# Verify current setting
sysctl kernel.io_uring_disabled
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
