SECURITY ANNOUNCEMENT

CVE-2026-99075

23 October 2026

Fix this by implementing DeliverToRead::cancel() for Node and NodeWrapper to move the pending refcount update to the process's work queue on thread exit so another thread can deliver it to userspace.

Introduced

6.18eafedbc7c050c44744fbdf80bdf3315e860b7513

Fixed releases

6.18.5771cbad138969edecef01b28dff87d91b56db538d

7.2.11fb0f8dfc5a030ed3d60a1d03acdc99c90ee99fc1

7.32a74ccd1bcc170e66525f34e9de8652b57e2cf3d

View source announcement ↗