Linux kernel io_uring task_work flood on cancellation
CVE-2026-99254 Published on November 3, 2026
io_uring: don't flood a cancelling task with task_work
In the Linux kernel, the following vulnerability has been resolved:
io_uring: don't flood a cancelling task with task_work
io_ring_exit_work() asks each task which has used the ring to remove its
tctx node, by task_work, and repeats that until the list is empty.
io_tctx_exit_cb() doesn't touch the node while the task is in
io_uring_cancel_generic(), which removes all the nodes at its end. So the
work item queues the callback again as soon as it has completed, for
nothing.
That is more than a waste of time. task_work_run() only returns when it
finds the list empty. If the rings are released from inside the
cancellation, because requests of other rings held the last references to
their files, up to 64 work items keep sending callbacks to the one task
which is running them. It never finds the list empty, never gets back to
the cancellation, the nodes stay, and so it goes on: a task with 60 pairs
of rings which poll each other ran 280000 callbacks in 5 seconds, 20
seconds after exit_group(). It ends when all the senders happen to be late
at the same time. Until then the task keeps a CPU and the work items busy.
An exiting task can't be killed meanwhile. execve() cancels the requests in
the same way, so a live task can get stuck there as well, for minutes. If
it takes more than five, the work items run into the
WARN_ON_ONCE(time_after(jiffies, timeout)) of io_ring_exit_work(). No
privilege is needed for any of this.
If the callback has met a task in cancellation, wait a little before it is
sent again. Nobody has to wake the work item up for that: either the node
is gone by then, or it is the turn of the next round.
Products Associated with CVE-2026-99254
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version d56d938b4bef3e1421a42023cdcd6e13c1f50831 and below a22fb44e988b01b82235ea07f0bf0fc73e256596 is affected.
- Version d56d938b4bef3e1421a42023cdcd6e13c1f50831 and below 2c75ebae8a7f09c99e31c7042b7d4d595f03b2b1 is affected.
- Version d56d938b4bef3e1421a42023cdcd6e13c1f50831 and below 61c761fc21e00e45c33c2bb596be442d92fb8792 is affected.
- Version d56d938b4bef3e1421a42023cdcd6e13c1f50831 and below 14f56e9c0b8fdc2e178acdbec9781e90ef46f7e9 is affected.
- Version d56d938b4bef3e1421a42023cdcd6e13c1f50831 and below abdc57c7ebabaaf0b622178a6a85834e1e54ff80 is affected.
- Version 5.12 is affected.
- Before 5.12 is unaffected.
- Version 6.1.191, <= 6.1.* is unaffected.
- Version 6.6.161, <= 6.6.* is unaffected.
- Version 6.12.115, <= 6.12.* is unaffected.
- Version 6.18.60, <= 6.18.* is unaffected.
- Version 7.2.14, <= 7.2.* is unaffected.