{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-99266",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2026-09-25T10:25:14.404Z",
        "datePublished": "2026-11-03T11:48:17.035Z",
        "dateUpdated": "2026-11-03T19:13:18.705Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-11-03T19:13:18.705Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/zcrx: fix buffer offsets in areas above 4GB\n\nio_zcrx_queue_cqe() computes the offset of the buffer in its area from\nnet_iov_idx(), which is an unsigned int, so the shift is done in 32 bits\nand only the result is widened to the u64 that goes into the CQE. An area\ncan be up to 1TB in size. For every niov beyond the first 4GB the CQE\npoints the application at a buffer 4GB, or a multiple of that, below the\none which has the data. It reads the wrong data, and then returns a\nbuffer it doesn't own via the refill queue while the real one is never\ngiven back."
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "io_uring/zcrx.c"
                    ],
                    "versions": [
                        {
                            "version": "11ed914bbf948c4a37248f2876973ac18014056d",
                            "lessThan": "9bfb315e2d0907fbcaf5d0453dd6d873c9aa8d5b",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "11ed914bbf948c4a37248f2876973ac18014056d",
                            "lessThan": "51f4ee29bf0564e6ae7d3540693a9bc1dd2c8fd7",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "11ed914bbf948c4a37248f2876973ac18014056d",
                            "lessThan": "ab4536bf2e5617b04f2d9396f06393c7bbfb071d",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "io_uring/zcrx.c"
                    ],
                    "versions": [
                        {
                            "version": "6.15",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "6.15",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.18.60",
                            "lessThanOrEqual": "6.18.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.2.14",
                            "lessThanOrEqual": "7.2.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.4-rc1",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.15",
                                    "versionEndExcluding": "6.18.60"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.15",
                                    "versionEndExcluding": "7.2.14"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.15",
                                    "versionEndExcluding": "7.4-rc1"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/9bfb315e2d0907fbcaf5d0453dd6d873c9aa8d5b"
                },
                {
                    "url": "https://git.kernel.org/stable/c/51f4ee29bf0564e6ae7d3540693a9bc1dd2c8fd7"
                },
                {
                    "url": "https://git.kernel.org/stable/c/ab4536bf2e5617b04f2d9396f06393c7bbfb071d"
                }
            ],
            "title": "io_uring/zcrx: fix buffer offsets in areas above 4GB",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}