SECURITY ANNOUNCEMENT

CVE-2026-99003

23 October 2026

If unprivileged userspace requests more queues than the firmware reported (but no more than MAX_CS_PER_CSG), cs_slot_prog_locked() fetches an uninitialized stream interface and may crash when dereferencing

Introduced

6.10de85488138247d034eb3241840424a54d660926b

Fixed releases

6.12.1134487cf79bf173f2b426a02d102076f8a20d23b96

6.18.57fdee3570b282a6c8699aea63fa5694355e010ec9

7.2.119be126be5f78bc331a930295af97c9b1f9158f06

7.3ec86c43dcfff68eab4db9bdafcd3e2b16e342e18

View source announcement ↗