{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"9bfb315e2d0907fbcaf5d0453dd6d873c9aa8d5b","status":"affected","version":"11ed914bbf948c4a37248f2876973ac18014056d","versionType":"git"},{"lessThan":"51f4ee29bf0564e6ae7d3540693a9bc1dd2c8fd7","status":"affected","version":"11ed914bbf948c4a37248f2876973ac18014056d","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"6.15"},{"lessThan":"6.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.60","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.14","versionType":"semver"}]}],"cveId":"CVE-2026-99266","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/zcrx: fix buffer offsets in areas above 4GB\n\nio_zcrx_queue_cqe() computes the offset of the buffer in its area from\nnet_iov_idx(), which is an unsigned int, so the shift is done in 32 bits\nand only the result is widened to the u64 that goes into the CQE. An area\ncan be up to 1TB in size. For every niov beyond the first 4GB the CQE\npoints the application at a buffer 4GB, or a multiple of that, below the\none which has the data. It reads the wrong data, and then returns a\nbuffer it doesn't own via the refill queue while the real one is never\ngiven back.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793706497035,"publishedAt":1793706497035,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/9bfb315e2d0907fbcaf5d0453dd6d873c9aa8d5b"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/51f4ee29bf0564e6ae7d3540693a9bc1dd2c8fd7"}],"remediation":[],"revision":"2856774908adecab29a6c627872c62d0d8423b052b245be5d30e5d0f5ec29b8d","sources":[{"modifiedAt":1793706497035,"name":"CNA: Linux","retrievedAt":1793707756789,"url":"https://www.cve.org/CVERecord?id=CVE-2026-99266"}],"ssvc":null,"status":"published","title":"io_uring/zcrx: fix buffer offsets in areas above 4GB","updatedAt":1793707756789}