Junglewise Threat Intelligence

CVE-2026-23113: Linux Kernel io_uring hung task in io-wq exit path

CVE-2026-23113 · Severity: medium · CVSS 5.5 · Published 2026-02-14

Technologies: Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Linux, Siemens.

Executive brief

A vulnerability in the Linux kernel's io_uring subsystem can cause the system to become unresponsive or hang during certain large data processing tasks. This occurs because the system fails to check for exit signals frequently enough when handling long-running background operations, such as massive file reads. An attacker or a malfunctioning application could exploit this to trigger a denial-of-service condition, potentially requiring a system reboot to recover.

Technical details

A vulnerability in the io_uring/io-wq component of the Linux kernel arises from the worker thread's failure to check the IO_WQ_BIT_EXIT flag inside the work run loop. In scenarios involving large I/O operations (e.g., 2GB reads on /dev/msr* files handled via loop_rw_iter), individual work items can take significant time to process. Because the exit bit was previously only checked before starting the work queue, the kernel could trigger 'hung task' timeouts (e.g., 140+ seconds) during process exit or ring cleanup. A local attacker can exploit this by queuing massive read operations to cause a denial-of-service (DoS) through uninterruptible sleep. The fix moves the IO_WQ_BIT_EXIT check inside the io_worker_handle_work() loop to allow immediate cancellation of pending items during exit.

Affected products

  • Linux Linux Kernel versions prior to 6.13-rc1
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2026-01-20: patched: Initial patch by Jens Axboe
  • 2026-02-14: advisory: CVE-2026-23113 published
  • 2026-07-14: other: Siemens confirmed impact on SIMATIC S7-1500 CPUs

References

Related threats