---
id: CVE-2026-99203
title: 'pipe: preserve existing fasync readers on writer setup failure'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  pipe: preserve existing fasync readers on writer setup failure

  F_SETFL and FIOASYNC decide whether to invoke ->fasync() before
  pipe_fasync() takes pipe->mutex. Two ena…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 76398425bb06b07cc3a3b1ce169c67dc9d6874ed <
    4c42ce499ce4b1c787e61082e3b13df4f30c4eaa
  - >-
    Linux >= 76398425bb06b07cc3a3b1ce169c67dc9d6874ed <
    2259809e5b7043c4ba20af7b14ba3e471cf55521
  - >-
    Linux >= 76398425bb06b07cc3a3b1ce169c67dc9d6874ed <
    40bb03d3ea6f6a915218508819ecc4d7a7fa260d
  - Linux 2.6.30
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T10:35:57.589Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99203'
references:
  - url: 'https://git.kernel.org/stable/c/4c42ce499ce4b1c787e61082e3b13df4f30c4eaa'
  - url: 'https://git.kernel.org/stable/c/2259809e5b7043c4ba20af7b14ba3e471cf55521'
  - url: 'https://git.kernel.org/stable/c/40bb03d3ea6f6a915218508819ecc4d7a7fa260d'
tags:
  - cve.org
ingestedAt: '2026-10-28T11:09:40.362Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

pipe: preserve existing fasync readers on writer setup failure

F_SETFL and FIOASYNC decide whether to invoke ->fasync() before
pipe_fasync() takes pipe->mutex. Two enables of one O_RDWR FIFO can
therefore both enter the callback.

fasync_helper() allocates before checking for an existing entry. If the
first enable installs both entries, a second enable can update the
reader entry and then fail the allocation for the writer entry. The
error path removes the pre-existing reader entry, clearing FASYNC while
the writer entry remains registered. __fput() then skips ->fasync(), so a
later pipe notification can dereference the freed file or its f_owner.
An unprivileged memory-pressure reproducer triggers a KASAN
slab-use-after-free in send_sigio() through this path.

Keep the reader helper's result and undo the registration only if this
call added it. The pipe mutex serializes changes to both lists, so a
failed new registration still removes its reader, while a failed
duplicate preserves the existing registrations and FASYNC. Successful
duplicate enables continue to update fa_fd as before.

## Affected

- `Linux >= 76398425bb06b07cc3a3b1ce169c67dc9d6874ed < 4c42ce499ce4b1c787e61082e3b13df4f30c4eaa`
- `Linux >= 76398425bb06b07cc3a3b1ce169c67dc9d6874ed < 2259809e5b7043c4ba20af7b14ba3e471cf55521`
- `Linux >= 76398425bb06b07cc3a3b1ce169c67dc9d6874ed < 40bb03d3ea6f6a915218508819ecc4d7a7fa260d`
- `Linux 2.6.30`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.