CVE-2026-46315

io_uring/waitid: clear waitid info before copying it to userspace

published June 9, 2026

CVSS
—
EPSS
0%
Percentile
1.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

io_uring/waitid: clear waitid info before copying it to userspace

IORING_OP_WAITID stores its result fields in struct io_waitid::info and

later copies them to userspace siginfo. The prep path initializes the

request arguments, but it does not initialize info itself.

If the wait operation completes without reporting a child event, the common

wait code can return without writing wo_info. In that case io_waitid_finish()

still copies iw->info to userspace, exposing stale bytes from the reused

io_kiocb command storage.

Clear the result storage during prep so the io_uring path matches the

regular waitid syscall, which uses a zero-initialized struct waitid_info.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00114 · 1.4th percentile
Published
2026-06-09T07:38Z
EPSS history
Timeline
  • 09 JUN 07:38Z
    io_uring/waitid: clear waitid info before copying it to userspace
    cvelistv5