Linux Kernel: io_uring timeout loss due to IO_WQ_WORK_CANCEL flag potential hang on cancel
CVE-2026-99262 Published on November 3, 2026
io_uring/timeout: don't lose a cancel as io-wq arms a timeout
In the Linux kernel, the following vulnerability has been resolved:
io_uring/timeout: don't lose a cancel as io-wq arms a timeout
An IORING_OP_TIMEOUT run by io-wq, because of IOSQE_ASYNC, has the same
problem as poll, futex and waitid. io_wq_submit_work() looks at
IO_WQ_WORK_CANCEL once, before it issues the request. A cancel in between
flags the work, gets -EALREADY, and searches ->timeout_list in vain,
while the worker then adds the request and starts the timer:
io-wq worker io_try_cancel()
io_wq_submit_work()
IO_WQ_WORK_CANCEL isn't set
io_async_cancel_one()
sets IO_WQ_WORK_CANCEL
= -EALREADY
io_timeout_cancel() = -ENOENT
io_timeout()
adds the request to ->timeout_list
hrtimer_start()
= IOU_ISSUE_SKIP_COMPLETE
Nobody looks at the flag again, and the timeout runs its course. At ring
exit, io_uring_try_cancel_requests() cancels io-wq work and then kills
the timeouts the same way, so an exiting task can get stuck for the full
duration of such a timeout.
Look at the flag under ->timeout_lock, which the search takes as well,
and fail the request if it is set. If the search came first, the flag is
visible. If it comes later, it finds the request on the list.
Products Associated with CVE-2026-99262
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version ce35a47a3a0208a77b4d31b7f2e8ed57d624093d and below f1fabf17f37b252b11d8fe5c70c8056b70b005ca is affected.
- Version ce35a47a3a0208a77b4d31b7f2e8ed57d624093d and below 68cd06ba918d9658c36c1973a0184795738dcc46 is affected.
- Version ce35a47a3a0208a77b4d31b7f2e8ed57d624093d and below f9d5e02649587885852f46b6dc7c081b87f0ac3a is affected.
- Version ce35a47a3a0208a77b4d31b7f2e8ed57d624093d and below f10ab47077e63d6eee35b242c257c3947bb49e64 is affected.
- Version ce35a47a3a0208a77b4d31b7f2e8ed57d624093d and below df705a274da10da7bb546e08b49fa80a6ef19c78 is affected.
- Version 5.6 is affected.
- Before 5.6 is unaffected.
- Version 6.1.191, <= 6.1.* is unaffected.
- Version 6.6.161, <= 6.6.* is unaffected.
- Version 6.12.115, <= 6.12.* is unaffected.
- Version 6.18.60, <= 6.18.* is unaffected.
- Version 7.2.14, <= 7.2.* is unaffected.