Linux Kernel CVE-2026-99231

Requires local access as an unprivileged user able to issue io_uring syscalls, and the io_uring subsystem must be enabled/reachable on the host (PR:L, AV:L). The specific trigger stated in the source is a race: io_waitid_wait() clears ->head before taking ownership via ->refs, so an attacker must win a narrow timing window where another path (io_waitid concurrent completion or __io_waitid_cancel) claims and frees the request, after which the freed slot is reused (the report shows reuse by a receive waiting for data). Limiting factors: exploitation is timing-sensitive and non-deterministic (the reporter held the window open with an artificial delay), it needs local presence rather than remote access, and it depends on io_uring being available to the attacking user - hosts that disable io_uring (e.g. via io_uring_disabled sysctl or seccomp) are not exposed.

Signals are mixed and point to a genuine but not emergency-grade local kernel issue. The provided CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) describes a locally exploitable, low-privilege flaw with full confidentiality, integrity and availability impact - consistent with a use-after-free in the io_uring waitid path that the description confirms leads to a KASAN slab-use-after-free and a reused/freed request. There is NO network exposure (AV:L), so this is a local privilege-escalation / memory-corruption class issue, not a remotely reachable one. No CISA KEV listing is present in the input, no EPSS score was supplied, and no proof-of-concept or exploit reference is included (the three references are kernel.org stable git commits, i.e. the fix itself). The vuln.today decision label is 'this_week', indicating elevated-but-not-critical urgency rather than act_now/emergency. One data conflict to flag explicitly: the Tags list 'Information Disclosure', but the CVSS vector and description indicate full C:H/I:H/A:H memory corruption via use-after-free - the impact is broader than information disclosure, so do not treat this as a read-only leak. EPSS is absent, so exploitation probability cannot be quantified. Overall this is a real priority for multi-tenant or untrusted-local-user Linux hosts, but the local-only vector and timing-dependent race meaningfully reduce real-world mass-exploitation likelihood.

A local unprivileged user on a Linux host with io_uring enabled submits concurrent io_uring waitid operations and races the completion/cancel path so that ->head is cleared before the handler owns the request, causing a freed request to be reused while the wake-up handler still touches it. Winning this narrow timing window yields a kernel use-after-free that can be groomed (as the report shows, the freed slot was reused by a receive operation) toward memory corruption and potential privilege escalation. No public exploit or PoC is identified in the available data; the only references are the upstream fix commits.