Linux
CVE-2026-99266: In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix buffer offsets in areas above 4GB io_zcrx_queue_cqe() computes the offs
CVE-2026-99266 Nov 3, 2026 Source: Vendor
In the Linux kernel, the following vulnerability has been resolved:
io_uring/zcrx: fix buffer offsets in areas above 4GB
io_zcrx_queue_cqe() computes the offset of the buffer in its area from
net_iov_idx(), which is an unsigned int, so the shift is done in 32 bits
and only the result is widened to the u64 that goes into the CQE. An area
can be up to 1TB in size. For every niov beyond the first 4GB the CQE
points the application at a buffer 4GB, or a multiple of that, below the
one which has th
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-99266
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
0 lines
No credit lines recorded on this release yet.