CVE-2026-99243

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: io-wq: order the exit bit against worker creation task work io_wq_exit_workers() cancels task work for queued worker creation with task_work_cancel_match(). That has a plain load of task->task_works. io_queue_worker_create() adds the new entry and tests IO_WQ_BIT_EXIT to cancel it if the workqueue is already on its way out. That must be ordered. task_work_add() has a full barrier via cmpxchg(). But io_wq_exit_start() sets the bit with set_bit() which doesn't have any memory ordering. So afaict, on weakly ordered architectures the exiting task may load task_works before the store of the bit is visible. The other side tests the bit before the store is visible as well. So the entry remains queued with worker_refs and the exiting task waits on worker_done indefinitely. If the task still has rings then io_uring_del_tctx_node() provides the barrier via test_and_set_bit() in io_wq_set_exit_on_idle(). When it has closed all rings though that barrier is gone. Add the barrier after the set_bit().

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-11-03 12:17:30.553000

Last modified

2026-11-03 12:17:30.553000

View original CVE JSON

{
  "id": "CVE-2026-99243",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-11-03T12:17:30.553",
  "lastModified": "2026-11-03T12:17:30.553",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio-wq: order the exit bit against worker creation task work\n\nio_wq_exit_workers() cancels task work for queued worker creation with\ntask_work_cancel_match(). That has a plain load of task->task_works.\n\nio_queue_worker_create() adds the new entry and tests IO_WQ_BIT_EXIT to\ncancel it if the workqueue is already on its way out.\n\nThat must be ordered. task_work_add() has a full barrier via cmpxchg().\nBut io_wq_exit_start() sets the bit with set_bit() which doesn't have\nany memory ordering.\n\nSo afaict, on weakly ordered architectures the exiting task may load\ntask_works before the store of the bit is visible. The other side tests\nthe bit before the store is visible as well. So the entry remains queued\nwith worker_refs and the exiting task waits on worker_done indefinitely.\n\nIf the task still has rings then io_uring_del_tctx_node() provides the\nbarrier via test_and_set_bit() in io_wq_set_exit_on_idle(). When it\nhas closed all rings though that barrier is gone.\n\nAdd the barrier after the set_bit()."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "io_uring/io-wq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "4b4e5bbf9386d4ec21d91c0cb0fd60b9bba778ec",
              "lessThan": "67da3eec264aeb67835886720243ae2dc1463315",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "71a85387546e50b1a37b0fa45dadcae3bfb35cf6",
              "lessThan": "a63c752157eacf49f628359822666b32503d194a",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "71a85387546e50b1a37b0fa45dadcae3bfb35cf6",
              "lessThan": "1432d881d99584105122760133caeff1dce7a9f7",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "71a85387546e50b1a37b0fa45dadcae3bfb35cf6",
              "lessThan": "6cf012a4d5e461c788ecc9dbed67adc31a142644",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "71a85387546e50b1a37b0fa45dadcae3bfb35cf6",
              "lessThan": "0d81cdd433b0a96c5275c01b8172e0b1f71dd595",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "71a85387546e50b1a37b0fa45dadcae3bfb35cf6",
              "lessThan": "75395db7a9b40a2e826c838e648fef8ed1a2d174",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "71a85387546e50b1a37b0fa45dadcae3bfb35cf6",
              "lessThan": "31fc780b75b278d37700373d54a99fdb4117fdd6",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "5.15.11",
              "lessThan": "5.15.224",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "io_uring/io-wq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "5.16",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "5.16",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.15.224",
              "lessThanOrEqual": "5.15.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.191",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.161",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.115",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.60",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.14",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3.1",
              "lessThanOrEqual": "7.3.*",
              "versionType": "semver",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0d81cdd433b0a96c5275c01b8172e0b1f71dd595",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/1432d881d99584105122760133caeff1dce7a9f7",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/31fc780b75b278d37700373d54a99fdb4117fdd6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/67da3eec264aeb67835886720243ae2dc1463315",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6cf012a4d5e461c788ecc9dbed67adc31a142644",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/75395db7a9b40a2e826c838e648fef8ed1a2d174",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a63c752157eacf49f628359822666b32503d194a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}