Linux kernel: Use-after-free in pipe fasync handling
Summary
A flaw in the Linux kernel pipe subsystem can leave SIGIO/async notification state inconsistent when a FIFO with O_RDWR is enabled for asynchronous notification twice and a memory allocation fails. A local user with low privileges could trigger a use-after-free in send_sigio(), which may lead to privilege escalation or a kernel crash. Exploitation requires local code execution and memory pressure.
Affected
- Linux kernel from commit 76398425bb06 (introduced in 2.6.30) until the fix commits listed in the references
- Fixed stable series: 5.10.273, 5.15.224, 6.1.191, 6.6.161, 6.12.115, 6.18.59, 7.2.13
- Exact affected ranges for distribution kernels may differ; check your distribution's advisory.
Fixed in
- Stable kernels 5.10.273, 5.15.224, 6.1.191, 6.6.161, 6.12.115, 6.18.59 and 7.2.13 and later
- Install the patched kernel from your Linux distribution.
Workaround
Unknown.
Exploitation
- Not known to be exploited in the wild.
- No public proof-of-concept or exploit found in the sources; the CVE record describes a KASAN use-after-free reproducer.
- No CISA KEV listing found.
Our recommendation
- Identify Linux hosts with multiple local users, such as shared servers, CI/build runners and container hosts.
- Install the distribution's kernel update and reboot the system.
- Restrict local shell access to trusted users.
- Monitor NVD and your distribution's security tracker until fixed versions are confirmed for your release.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux kernel stable fix commit 2259809e5b70 git.kernel.org
- Linux kernel stable fix commit 40bb03d3ea6f git.kernel.org
- Linux kernel stable fix commit 6041bcd185d4 git.kernel.org
- Ubuntu security record CVE-2026-99203 ubuntu.com
- OSV BELL-CVE-2026-99203 osv.dev
- Armbian CVE patches 2026-10-31 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:56.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: pipe: preserve existing fasync readers on writer setup failure F_SETFL and FIOASYNC decide whether to invoke ->fasync() before pipe_fasync() takes pipe->mutex. Two enables of one O_RDWR FIFO can therefore both enter the callback. fasync_helper() allocates before checking for an existing entry. If the first enable installs both entries, a second enable can update the reader entry and then fail the allocation for the writer entry. The error path removes the pre-existing reader entry, clearing FASYNC while the writer entry remains registered. __fput() then skips ->fasync(), so a later pipe notification can dereference the freed file or its f_owner. An unprivileged memory-pressure reproducer triggers a KASAN slab-use-after-free in send_sigio() through this path. Keep the reader helper's result and undo the registration only if this call added it. The pipe mutex serializes changes to both lists, so a failed new registration still removes its reader, while a failed duplicate preserves the existing registrations and FASYNC. Successful duplicate enables continue to update fa_fd as before.
NVD references (8)
- https://git.kernel.org/stable/c/2259809e5b7043c4ba20af7b14ba3e471cf55521
- https://git.kernel.org/stable/c/22c7f57b0c0b0b8e19cfb41a1bd85f55715ad386
- https://git.kernel.org/stable/c/40bb03d3ea6f6a915218508819ecc4d7a7fa260d
- https://git.kernel.org/stable/c/4c42ce499ce4b1c787e61082e3b13df4f30c4eaa
- https://git.kernel.org/stable/c/6041bcd185d4df051490fe166e64feae6c3b8291
- https://git.kernel.org/stable/c/7cdbfa22a7e270b155ddb958b1583a999c0c8abb
- https://git.kernel.org/stable/c/94be790dd6fbe0912f35bb711bea8ef3687eaca9
- https://git.kernel.org/stable/c/9b0aa2a1d8df51f3dcb363c3a2d9531098e88dc6
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.