io_uring/io-wq: don't lose the signal that ends work

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-99228
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-11-02 16:17:47 UTC
Updated2026-11-06 18:18:32 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: io_uring/io-wq: don't lose the signal that ends work When a thread exits, only its tracked requests are cancelled. Then its io-wq is torn down. io_wq_exit_workers() signals every worker, to get it out of an interruptible sleep, and waits for all of them to exit. Before they do, they go through the work that is left. Unbounded work is cancelled. Bounded work is run, as it is expected to end by itself. Not all of it does. An open has no file yet, so it counts as bounded, and the open of a FIFO waits for the other end. That is what the signal is for. But the workers are signalled once, and a worker that hasn't started the work by then loses the signal: io_wq_exit_workers() io_worker_handle_work() io_wq_worker_wake() set TIF_NOTIFY_SIGNAL io_assign_current_work() io_run_task_work() clear TIF_NOTIFY_SIGNAL io_wq_submit_work() fifo_open() wait_for_partner() wait_for_completion_timeout() The thread never gets out of do_exit(): IORING_OP_OPENAT of a FIFO without a writer, IOSQE_ASYNC exit of the thread that has submitted it hangs in more than 9 of 10 attempts (4 CPUs, KVM), until the process is killed. Set TIF_NOTIFY_SIGNAL for bounded work that is started with IO_WQ_BIT_EXIT set. The bit is set before the workers are signalled, and it is tested after the flag has been cleared, with clear_notify_signal() providing the barrier. So either the flag stays, or the bit is seen. Work that is started while the io-wq exits is treated like work that is being run at that time: it isn't interrupted unless it waits interruptibly.

Risk And Classification

EPSS: 0.001570000 probability, percentile 0.048350000 (date 2026-11-03)

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected afcc4015d1bf5659b8c722aff679e9b8c41ee156 ddccc60f036b309430cf130d48aafed94ef7355a git Not specified
CNA Linux Linux affected afcc4015d1bf5659b8c722aff679e9b8c41ee156 08c42055b8f9a5d29236d34ad4bce08828239fe1 git Not specified
CNA Linux Linux affected afcc4015d1bf5659b8c722aff679e9b8c41ee156 62996803c1b5f18176de255db4c843021f2d19c8 git Not specified
CNA Linux Linux affected afcc4015d1bf5659b8c722aff679e9b8c41ee156 7309fea05a3d66af9746843c43fef14c10b8141e git Not specified
CNA Linux Linux affected afcc4015d1bf5659b8c722aff679e9b8c41ee156 fdb771015c1e13677b57a4015f0c938748f13781 git Not specified
CNA Linux Linux affected afcc4015d1bf5659b8c722aff679e9b8c41ee156 7df9a3b5eda51c512d3dd138e3b7daa525071757 git Not specified
CNA Linux Linux affected afcc4015d1bf5659b8c722aff679e9b8c41ee156 63c103279a95e82280092f2f4232e91e8117a252 git Not specified
CNA Linux Linux affected 5.12 Not specified
CNA Linux Linux unaffected 5.12 semver Not specified
CNA Linux Linux unaffected 6.1.191 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.161 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.115 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.60 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.14 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3.2 7.3.* semver Not specified
CNA Linux Linux unaffected 7.4-rc1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/fdb771015c1e13677b57a4015f0c938748f13781 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/62996803c1b5f18176de255db4c843021f2d19c8 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/7df9a3b5eda51c512d3dd138e3b7daa525071757 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/7309fea05a3d66af9746843c43fef14c10b8141e 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/08c42055b8f9a5d29236d34ad4bce08828239fe1 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/63c103279a95e82280092f2f4232e91e8117a252 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/ddccc60f036b309430cf130d48aafed94ef7355a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report