Executive brief
A vulnerability was identified in the Linux kernel's io_uring subsystem where background tasks could continue running even after the system requested they stop. This occurs because the system was only checking for an exit signal at the start of a task chain rather than for every individual item in that chain. While primarily a performance and stability issue that can cause system shutdown or ring closure to take an excessively long time, it represents a failure in the kernel's task management logic.
Technical details
A race condition exists in the io-wq (io_uring worker queue) implementation within the Linux kernel. The function io_worker_handle_work() previously snapshotted the IO_WQ_BIT_EXIT state only once before processing an entire chain of dependent linked-work items. If an exit was initiated (via io_wq_exit_start()) after the first item in a chain started, subsequent linked items would use a stale 'do_kill = false' flag, bypassing the IO_WQ_WORK_CANCEL check. This allows linked work to continue execution despite the queue being in an exit state. The fix moves the bit check inside the inner loop that handles dependent links to ensure every item respects the exit signal.
Affected products
- Linux Linux Kernel io_uring component
Timeline
- 2026-05-28: patched: Initial fix commit in upstream kernel
- 2026-07-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/14b7ecad2ec56699325180a744f4b19f046401bb
- https://git.kernel.org/stable/c/1636d85dc139b07c0449308f2bb5e0c7a2e0da99
- https://git.kernel.org/stable/c/29bef9934b2521f787bb15dd1985d4c0d12ae02a
- https://git.kernel.org/stable/c/6e2f51f3e06773c2ee98ad09738f0908b48f76f9
- https://git.kernel.org/stable/c/ab85765cbe3258b43dc6729af0e6ce3a87a133d8
- https://git.kernel.org/stable/c/b6f179a653a934736c88d820fe0098c3c2532549
- https://git.kernel.org/stable/c/d179533c610e1b4c6aa436e3c1fd1b719d2c727c