CVE-2026-99228
io_uring/io-wq: don't lose the signal that ends work
- Published
- Updated
- Reserved
- Assigned by
- Linux
Description
In the Linux kernel, the following vulnerability has been resolved: io_uring/io-wq: don't lose the signal that ends work When a thread exits, only its tracked requests are cancelled. Then its io-wq is torn down. io_wq_exit_workers() signals every worker, to get it out of an interruptible sleep, and waits for all of them to exit. Before they do, they go through the work that is left. Unbounded work is cancelled. Bounded work is run, as it is expected to end by itself. Not all of it does. An open has no file yet, so it counts as bounded, and the open of a FIFO waits for the other end. That is what the signal is for. But the workers are signalled once, and a worker that hasn't started the work by then loses the signal: io_wq_exit_workers() io_worker_handle_work() io_wq_worker_wake() set TIF_NOTIFY_SIGNAL io_assign_current_work() io_run_task_work() clear TIF_NOTIFY_SIGNAL io_wq_submit_work() fifo_open() wait_for_partner() wait_for_completion_timeout() The thread never gets out of do_exit(): IORING_OP_OPENAT of a FIFO without a writer, IOSQE_ASYNC exit of the thread that has submitted it hangs in more than 9 of 10 attempts (4 CPUs, KVM), until the process is killed. Set TIF_NOTIFY_SIGNAL for bounded work that is started with IO_WQ_BIT_EXIT set. The bit is set before the workers are signalled, and it is tested after the flag has been cleared, with clear_notify_signal() providing the barrier. So either the flag stays, or the bit is seen. Work that is started while the io-wq exits is treated like work that is being run at that time: it isn't interrupted unless it waits interruptibly.
Timeline
ID reserved
By Linux
- 38 days later
· 38 days later
Published
- 4 days later
· 4 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.16% · top 95% of all CVEs (7 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected afcc4015d1bf5659b8c722aff679e9b8c41ee156 – < ddccc60f036b309430cf130d48aafed94ef7355a
- affected afcc4015d1bf5659b8c722aff679e9b8c41ee156 – < 08c42055b8f9a5d29236d34ad4bce08828239fe1
- affected afcc4015d1bf5659b8c722aff679e9b8c41ee156 – < 62996803c1b5f18176de255db4c843021f2d19c8
- affected afcc4015d1bf5659b8c722aff679e9b8c41ee156 – < 7309fea05a3d66af9746843c43fef14c10b8141e
- affected afcc4015d1bf5659b8c722aff679e9b8c41ee156 – < fdb771015c1e13677b57a4015f0c938748f13781
- affected afcc4015d1bf5659b8c722aff679e9b8c41ee156 – < 7df9a3b5eda51c512d3dd138e3b7daa525071757
- affected afcc4015d1bf5659b8c722aff679e9b8c41ee156 – < 63c103279a95e82280092f2f4232e91e8117a252
- affected 5.12
- unaffected < 5.12
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.161 – ≤ 6.6.*
- unaffected 6.12.115 – ≤ 6.12.*
- unaffected 6.18.60 – ≤ 6.18.*
- unaffected 7.2.14 – ≤ 7.2.*
- unaffected 7.3.2 – ≤ 7.3.*
- unaffected 7.4-rc1 – ≤ *
References (7)
- https://git.kernel.org/stable/c/ddccc60f036b309430cf130d48aafed94ef7355a (opens in a new tab)
- https://git.kernel.org/stable/c/08c42055b8f9a5d29236d34ad4bce08828239fe1 (opens in a new tab)
- https://git.kernel.org/stable/c/62996803c1b5f18176de255db4c843021f2d19c8 (opens in a new tab)
- https://git.kernel.org/stable/c/7309fea05a3d66af9746843c43fef14c10b8141e (opens in a new tab)
- https://git.kernel.org/stable/c/fdb771015c1e13677b57a4015f0c938748f13781 (opens in a new tab)
- https://git.kernel.org/stable/c/7df9a3b5eda51c512d3dd138e3b7daa525071757 (opens in a new tab)
- https://git.kernel.org/stable/c/63c103279a95e82280092f2f4232e91e8117a252 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-99228)Record last updated .