Executive brief
The Linux kernel's io_uring subsystem (a high-performance I/O interface) contained a deadlock risk when using eventfd notifications within certain ring configurations. Under specific conditions, eventfd signal handlers could recursively re-enter locking code paths held by waitqueue handlers, potentially freezing the system or causing resource exhaustion. This patch defers problematic signal operations to prevent the recursive lock scenario.
Technical details
This is a synchronization/deadlock vulnerability in the Linux kernel's io_uring subsystem. The root cause: io_req_local_work_add() signals the CQ ring eventfd inline when queuing work from a waitqueue wakeup handler, where an arbitrary waitqueue lock is held. The eventfd_signal_mask() function only checks the current->in_eventfd flag (which it sets itself), so if the wake chain originates elsewhere, the signal proceeds inline and can feed back into epoll, recursing into held locks. The fix introduces a new IOU_F_TWQ_IN_WAKE flag to detect when task_work is being queued from a waitqueue callback, and forces eventfd signaling to defer via call_rcu_hurry() instead of signaling inline. This prevents the lock recursion. No network attack vector; the vulnerability affects local kernel operation and system stability. Patches have been committed to the Linux kernel stable tree (commit cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e).
Affected products
- Linux Linux kernel 5.0 and later (io_uring feature availability)
Timeline
- 2026-09-09: disclosed
- 2026-08-27: patched