PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-43366 Git CVE debrief

CVE-2026-43366 is a Linux kernel io_uring/kbuf vulnerability in the legacy buffer recycle path. The reported gap is between the time a buffer is grabbed and the later recycle step: if the list becomes empty in that window, it may be upgraded to a ring-provided type, including when the request is forced through io-wq. The vulnerable recycling logic did not verify that the buffer_list still existed or that it was still the legacy type. The resolved change adds those checks before recycling proceeds.

Vendor
Git
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-08
Original CVE updated
2026-05-11
Advisory published
2026-05-08
Advisory updated
2026-05-11

Who should care

Linux kernel maintainers, distro security and kernel teams, and operators of systems that rely on io_uring/io-wq should review this CVE. It is a local, low-privilege issue with high CVSS impact, so multi-user and exposed server environments should prioritize patching.

Technical summary

NVD lists CVSS v3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The issue is described as a race/gap in io_uring/kbuf legacy recycling: a buffer can be grabbed, the list can be emptied and converted to a ring-provided type before recycle, and the old recycle logic did not re-check that the target buffer_list was still present and still legacy. The fix adds those validation checks in the recycle path.

Defensive priority

High. This is a kernel-level flaw with local attack prerequisites but potentially severe confidentiality, integrity, and availability impact.

Recommended defensive actions

  • Apply the Linux kernel stable or vendor updates that include the io_uring/kbuf recycle fix.
  • Prioritize patching hosts that enable io_uring and may use io-wq for forced request handling.
  • Verify downstream backports include the added buffer_list existence and type checks in the legacy recycle path.
  • Review distro and kernel advisories for the specific release train in use before maintenance windows.
  • Treat this as a high-priority local-privilege risk on shared or multi-tenant systems.

Evidence notes

This debrief is based only on the supplied CVE/NVD record and the kernel stable references listed there. The CVE description explicitly states the race window, the possible upgrade to a ring-provided type, the io-wq forcing condition, and the missing checks on recycle. The source corpus does not include exploit code, confirmed exploitation, or impacted version ranges. CVE publishedAt: 2026-05-08T15:16:47.623Z; modifiedAt: 2026-05-11T08:16:11.427Z.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-43366 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-43366

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-43366 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-43366

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/439a6728ec4641ffad1ca796622c19bc525e570f

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/50ad880db3013c6fee0ef13781762a39e2e7ef83

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/97b57f69fee1b61b41acbf37e7720cac9d389fa4

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a7b33671e418fca507feebd1d56e7f4952a4b25c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c2c185be5c85d37215397c8e8781abf0a69bec1f

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f3fb54e7a8b4aadcc2836ee463eec8c88709b8aa

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.