CVE-2026-99096: Linux kernel · io_uring/register: don't exempt disabled rings from task restrictions
Affects Linux kernelSource CVE Database V5
Not known to be exploited : upgrade to f55c240192ded562386de843bfa067671d2731d5 or 6da8f402e362b2f546e2efb7167fc9597aef6faf soon.
Data as of 26 Oct 2026, 17:30 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
- Patch
- Available – fixed in f55c240192ded562386de843bfa067671d2731d5, 6da8f402e362b2f546e2efb7167fc9597aef6faf
Exploitation evidence
Disclosed: evidence found.
CVE published 26 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade Linux kernel to f55c240192ded562386de843bfa067671d2731d5 or 6da8f402e362b2f546e2efb7167fc9597aef6faf.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
Red Hatredhat/kernelpkg:rpm/redhat/kernelOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A fix has been applied in the Linux kernel (commits f55c240192ded562386de843bfa067671d2731d5 and 6da8f402e362b2f546e2efb7167fc9597aef6faf) that enforces register opcode restrictions on disabled rings that inherit task restrictions. Users should update to a Linux kernel version including these commits to remediate the issue.
Description
A vulnerability in the Linux kernel's io_uring subsystem allowed disabled rings to bypass task restrictions on register operations until enabled. This could let a task with restricted register opcodes create a disabled ring, perform any register opcode on it, and then enable the ring without proper permission. The issue has been fixed by ensuring that rings inheriting restrictions from tasks are checked even while disabled, requiring explicit permission to enable them.