{"api_version":"1","generated_at":"2026-04-23T07:01:20+00:00","cve":"CVE-2026-23473","urls":{"html":"https://cve.report/CVE-2026-23473","api":"https://cve.report/api/cve/CVE-2026-23473.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-23473","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-23473"},"summary":{"title":"io_uring/poll: fix multishot recv missing EOF on wakeup race","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/poll: fix multishot recv missing EOF on wakeup race\n\nWhen a socket send and shutdown() happen back-to-back, both fire\nwake-ups before the receiver's task_work has a chance to run. The first\nwake gets poll ownership (poll_refs=1), and the second bumps it to 2.\nWhen io_poll_check_events() runs, it calls io_poll_issue() which does a\nrecv that reads the data and returns IOU_RETRY. The loop then drains all\naccumulated refs (atomic_sub_return(2) -> 0) and exits, even though only\nthe first event was consumed. Since the shutdown is a persistent state\nchange, no further wakeups will happen, and the multishot recv can hang\nforever.\n\nCheck specifically for HUP in the poll loop, and ensure that another\nloop is done to check for status if more than a single poll activation\nis pending. This ensures we don't lose the shutdown event.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-04-03 16:16:35","updated_at":"2026-04-07 13:20:55"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/0f4ce79b8db7b040373fc664c8bc6c5fd74bd196","name":"https://git.kernel.org/stable/c/0f4ce79b8db7b040373fc664c8bc6c5fd74bd196","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/a68ed2df72131447d131531a08fe4dfcf4fa4653","name":"https://git.kernel.org/stable/c/a68ed2df72131447d131531a08fe4dfcf4fa4653","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/bf33554b6abf7e7faeadd8af1b82037ea755a6bb","name":"https://git.kernel.org/stable/c/bf33554b6abf7e7faeadd8af1b82037ea755a6bb","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-23473","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23473","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected dbc2564cfe0faff439dc46adb8c009589054ea46 0f4ce79b8db7b040373fc664c8bc6c5fd74bd196 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected dbc2564cfe0faff439dc46adb8c009589054ea46 bf33554b6abf7e7faeadd8af1b82037ea755a6bb git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected dbc2564cfe0faff439dc46adb8c009589054ea46 a68ed2df72131447d131531a08fe4dfcf4fa4653 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.19","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.19 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.20 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.19.10 6.19.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.0-rc5 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"23473","cve":"CVE-2026-23473","epss":"0.000170000","percentile":"0.039750000","score_date":"2026-04-07","updated_at":"2026-04-08 00:03:39"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["io_uring/poll.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0f4ce79b8db7b040373fc664c8bc6c5fd74bd196","status":"affected","version":"dbc2564cfe0faff439dc46adb8c009589054ea46","versionType":"git"},{"lessThan":"bf33554b6abf7e7faeadd8af1b82037ea755a6bb","status":"affected","version":"dbc2564cfe0faff439dc46adb8c009589054ea46","versionType":"git"},{"lessThan":"a68ed2df72131447d131531a08fe4dfcf4fa4653","status":"affected","version":"dbc2564cfe0faff439dc46adb8c009589054ea46","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["io_uring/poll.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.19"},{"lessThan":"5.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0-rc5","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.20","versionStartIncluding":"5.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.19.10","versionStartIncluding":"5.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.0-rc5","versionStartIncluding":"5.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/poll: fix multishot recv missing EOF on wakeup race\n\nWhen a socket send and shutdown() happen back-to-back, both fire\nwake-ups before the receiver's task_work has a chance to run. The first\nwake gets poll ownership (poll_refs=1), and the second bumps it to 2.\nWhen io_poll_check_events() runs, it calls io_poll_issue() which does a\nrecv that reads the data and returns IOU_RETRY. The loop then drains all\naccumulated refs (atomic_sub_return(2) -> 0) and exits, even though only\nthe first event was consumed. Since the shutdown is a persistent state\nchange, no further wakeups will happen, and the multishot recv can hang\nforever.\n\nCheck specifically for HUP in the poll loop, and ensure that another\nloop is done to check for status if more than a single poll activation\nis pending. This ensures we don't lose the shutdown event."}],"providerMetadata":{"dateUpdated":"2026-04-03T15:15:51.928Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/0f4ce79b8db7b040373fc664c8bc6c5fd74bd196"},{"url":"https://git.kernel.org/stable/c/bf33554b6abf7e7faeadd8af1b82037ea755a6bb"},{"url":"https://git.kernel.org/stable/c/a68ed2df72131447d131531a08fe4dfcf4fa4653"}],"title":"io_uring/poll: fix multishot recv missing EOF on wakeup race","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-23473","datePublished":"2026-04-03T15:15:51.928Z","dateReserved":"2026-01-13T15:37:46.022Z","dateUpdated":"2026-04-03T15:15:51.928Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-04-03 16:16:35","lastModifiedDate":"2026-04-07 13:20:55","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"23473","Ordinal":"1","Title":"io_uring/poll: fix multishot recv missing EOF on wakeup race","CVE":"CVE-2026-23473","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"23473","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/poll: fix multishot recv missing EOF on wakeup race\n\nWhen a socket send and shutdown() happen back-to-back, both fire\nwake-ups before the receiver's task_work has a chance to run. The first\nwake gets poll ownership (poll_refs=1), and the second bumps it to 2.\nWhen io_poll_check_events() runs, it calls io_poll_issue() which does a\nrecv that reads the data and returns IOU_RETRY. The loop then drains all\naccumulated refs (atomic_sub_return(2) -> 0) and exits, even though only\nthe first event was consumed. Since the shutdown is a persistent state\nchange, no further wakeups will happen, and the multishot recv can hang\nforever.\n\nCheck specifically for HUP in the poll loop, and ensure that another\nloop is done to check for status if more than a single poll activation\nis pending. This ensures we don't lose the shutdown event.","Type":"Description","Title":"io_uring/poll: fix multishot recv missing EOF on wakeup race"}]}}}