In the Linux kernel, the following vulnerability has been resolved: pipe: preserve existing fasync readers on writer setup failure FSETFL…
CVE-2026-99203
In the Linux kernel, the following vulnerability has been resolved: pipe: preserve existing fasync readers on writer setup failure FSETFL and FIOASYNC decide whether to invoke ->fasync() before pipefasync() takes pipe->mutex. Two enables of one ORDWR FIFO can therefore both enter the callback. fasynchelper() allocates before checking for an existing entry. If the first enable installs both entries, a second enable can update the reader entry and then fail the allocation for the writer entry. The error path removes the pre-existing reader entry, clearing FASYNC while the writer entry remains registered. fput() then skips ->fasync(), so a later pipe notification can dereference the freed file or its fowner. An unprivileged memory-pressure reproducer triggers a KASAN slab-use-after-free in sendsigio() through this path. Keep the reader helper's result and undo the registration only if this call added it. The pipe mutex serializes changes to both lists, so a failed new registration still removes its reader, while a failed duplicate preserves the existing registrations and FASYNC. Successful duplicate enables continue to update fafd as before.
Assessment
- CVSS
- 7.8 (v3.1)
- Severity
- High
- EPSS
- 0.16% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 28 October 2026
- Last updated
- 31 October 2026
- Affected
- Linux
- Assigner
- Linux
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
At the source
References
- https://git.kernel.org/stable/c/6041bcd185d4df051490fe166e64feae6c3b8291
- https://git.kernel.org/stable/c/7cdbfa22a7e270b155ddb958b1583a999c0c8abb
- https://git.kernel.org/stable/c/22c7f57b0c0b0b8e19cfb41a1bd85f55715ad386
- https://git.kernel.org/stable/c/94be790dd6fbe0912f35bb711bea8ef3687eaca9
- https://git.kernel.org/stable/c/9b0aa2a1d8df51f3dcb363c3a2d9531098e88dc6
- https://git.kernel.org/stable/c/4c42ce499ce4b1c787e61082e3b13df4f30c4eaa
- https://git.kernel.org/stable/c/2259809e5b7043c4ba20af7b14ba3e471cf55521
- https://git.kernel.org/stable/c/40bb03d3ea6f6a915218508819ecc4d7a7fa260d
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-99203