Executive brief
The Linux kernel's io_uring subsystem (used to accelerate I/O operations in applications) incorrectly handles the cancellation of async wait operations. When a wait request is canceled, the system may attempt to process it in the wrong execution context (a background worker instead of the submitting task), leading to memory access violations or incorrect behavior that could crash the system or allow privilege escalation.
Technical details
The vulnerability exists in the io_uring waitid implementation (io_waitid_cb function). When task_work_add() fails to queue work to the originating task, a fallback path runs from a kernel worker, marking the work as canceled via tw.cancel. However, io_waitid_cb() was ignoring the tw.cancel flag and unconditionally calling __do_wait(), which is task-context dependent and performs child process lookup relative to 'current'. If the callback runs from a kworker, 'current' is not the submitting task, causing incorrect siginfo structures to be copied to userspace and potential access violations. The fix adds a check for tw.cancel at the start of io_waitid_cb(); if set, the request completes with -ECANCELED without attempting the context-dependent __do_wait() call.
Affected products
- Linux Linux kernel Affected versions include kernels with io_uring WAITID support (introduced in earlier versions, patched as of 2026-09-11)
Timeline
- 2026-09-11: disclosed: Published in NVD
- 2026-08-25: patched: Upstream fix committed by Jens Axboe
- 2026-09-14: other: Fix included in stable kernel releases