{"id":"CVE-2026-46315","title":"io_uring/waitid: clear waitid info before copying it to userspace","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/waitid: clear waitid info before copying it to userspace\n\nIORING_OP_WAITID stores its result fields in struct io_waitid::info and\nlater copies them to userspac…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= f31ecf671ddc498f20219453395794ff2383e06b < 954518e5a4a5efc5033253f6e36fc7b9f98363a3","Linux >= f31ecf671ddc498f20219453395794ff2383e06b < b737c6612c60c23b40a9f31749b99e6f61943847","Linux >= f31ecf671ddc498f20219453395794ff2383e06b < 4d2a0de611ab60d02fc768ae0cd5918b16bd5474","Linux >= f31ecf671ddc498f20219453395794ff2383e06b < 93d93f5f8da791e98159795c6ef683f45bd95d13","Linux 6.7"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:13:58.822519Z"},"published":"2026-06-09","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:23:49.402Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-46315","references":[{"url":"https://git.kernel.org/stable/c/954518e5a4a5efc5033253f6e36fc7b9f98363a3"},{"url":"https://git.kernel.org/stable/c/b737c6612c60c23b40a9f31749b99e6f61943847"},{"url":"https://git.kernel.org/stable/c/4d2a0de611ab60d02fc768ae0cd5918b16bd5474"},{"url":"https://git.kernel.org/stable/c/93d93f5f8da791e98159795c6ef683f45bd95d13"}],"tags":["cve.org"],"epss":0.00114,"epssPercentile":0.01464,"ingestedAt":"2026-11-06T16:57:43.314Z","slug":"CVE-2026-46315","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/waitid: clear waitid info before copying it to userspace\n\nIORING_OP_WAITID stores its result fields in struct io_waitid::info and\nlater copies them to userspace siginfo. The prep path initializes the\nrequest arguments, but it does not initialize info itself.\n\nIf the wait operation completes without reporting a child event, the common\nwait code can return without writing wo_info. In that case io_waitid_finish()\nstill copies iw->info to userspace, exposing stale bytes from the reused\nio_kiocb command storage.\n\nClear the result storage during prep so the io_uring path matches the\nregular waitid syscall, which uses a zero-initialized struct waitid_info.\n\n## Affected\n\n- `Linux >= f31ecf671ddc498f20219453395794ff2383e06b < 954518e5a4a5efc5033253f6e36fc7b9f98363a3`\n- `Linux >= f31ecf671ddc498f20219453395794ff2383e06b < b737c6612c60c23b40a9f31749b99e6f61943847`\n- `Linux >= f31ecf671ddc498f20219453395794ff2383e06b < 4d2a0de611ab60d02fc768ae0cd5918b16bd5474`\n- `Linux >= f31ecf671ddc498f20219453395794ff2383e06b < 93d93f5f8da791e98159795c6ef683f45bd95d13`\n- `Linux 6.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}