Linux Kernel EUVD-2026-35373

The vulnerability lives in the Linux kernel's io_uring subsystem (io_uring/waitid.c), specifically in the IORING_OP_WAITID code path, which wraps the waitid(2) syscall for asynchronous process state monitoring. io_uring, introduced in Linux 5.1, uses a shared ring buffer between kernel and userspace and reuses io_kiocb slab objects across requests. The struct io_waitid embeds an info field of type struct waitid_info that is supposed to receive wait result data, but the prep function does not initialize it to zero. The regular waitid(2) syscall uses a zero-initialized struct waitid_info on the stack, so this code path diverged from the safe baseline. The introduced commit f31ecf671ddc498f20219453395794ff2383e06b is the origin of the flaw. When the underlying wait returns without reporting a child event (e.g., WNOHANG with no matching child state), the common wait code returns without populating wo_info, and io_waitid_finish() then copies the uninitialized iw->info bytes directly to userspace. No CWE was assigned by NVD, but this is structurally a CWE-908 (Use of Uninitialized Resource) leading to kernel memory disclosure.