---
id: CVE-2026-46315
title: 'io_uring/waitid: clear waitid info before copying it to userspace'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  io_uring/waitid: clear waitid info before copying it to userspace

  IORING_OP_WAITID stores its result fields in struct io_waitid::info and
  later copies them to userspac…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f31ecf671ddc498f20219453395794ff2383e06b <
    954518e5a4a5efc5033253f6e36fc7b9f98363a3
  - >-
    Linux >= f31ecf671ddc498f20219453395794ff2383e06b <
    b737c6612c60c23b40a9f31749b99e6f61943847
  - >-
    Linux >= f31ecf671ddc498f20219453395794ff2383e06b <
    4d2a0de611ab60d02fc768ae0cd5918b16bd5474
  - >-
    Linux >= f31ecf671ddc498f20219453395794ff2383e06b <
    93d93f5f8da791e98159795c6ef683f45bd95d13
  - Linux 6.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:13:58.822519Z'
published: '2026-06-09'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:23:49.402Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-46315'
references:
  - url: 'https://git.kernel.org/stable/c/954518e5a4a5efc5033253f6e36fc7b9f98363a3'
  - url: 'https://git.kernel.org/stable/c/b737c6612c60c23b40a9f31749b99e6f61943847'
  - url: 'https://git.kernel.org/stable/c/4d2a0de611ab60d02fc768ae0cd5918b16bd5474'
  - url: 'https://git.kernel.org/stable/c/93d93f5f8da791e98159795c6ef683f45bd95d13'
tags:
  - cve.org
epss: 0.00114
epssPercentile: 0.01464
ingestedAt: '2026-11-06T16:57:43.314Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

io_uring/waitid: clear waitid info before copying it to userspace

IORING_OP_WAITID stores its result fields in struct io_waitid::info and
later copies them to userspace siginfo. The prep path initializes the
request arguments, but it does not initialize info itself.

If the wait operation completes without reporting a child event, the common
wait code can return without writing wo_info. In that case io_waitid_finish()
still copies iw->info to userspace, exposing stale bytes from the reused
io_kiocb command storage.

Clear the result storage during prep so the io_uring path matches the
regular waitid syscall, which uses a zero-initialized struct waitid_info.

## Affected

- `Linux >= f31ecf671ddc498f20219453395794ff2383e06b < 954518e5a4a5efc5033253f6e36fc7b9f98363a3`
- `Linux >= f31ecf671ddc498f20219453395794ff2383e06b < b737c6612c60c23b40a9f31749b99e6f61943847`
- `Linux >= f31ecf671ddc498f20219453395794ff2383e06b < 4d2a0de611ab60d02fc768ae0cd5918b16bd5474`
- `Linux >= f31ecf671ddc498f20219453395794ff2383e06b < 93d93f5f8da791e98159795c6ef683f45bd95d13`
- `Linux 6.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.