CVE-2026-99243
Received Received - Intake

Race Condition in Linux Kernel io-wq Worker Creation

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: io-wq: order the exit bit against worker creation task work io_wq_exit_workers() cancels task work for queued worker creation with task_work_cancel_match(). That has a plain load of task->task_works. io_queue_worker_create() adds the new entry and tests IO_WQ_BIT_EXIT to cancel it if the workqueue is already on its way out. That must be ordered. task_work_add() has a full barrier via cmpxchg(). But io_wq_exit_start() sets the bit with set_bit() which doesn't have any memory ordering. So afaict, on weakly ordered architectures the exiting task may load task_works before the store of the bit is visible. The other side tests the bit before the store is visible as well. So the entry remains queued with worker_refs and the exiting task waits on worker_done indefinitely. If the task still has rings then io_uring_del_tctx_node() provides the barrier via test_and_set_bit() in io_wq_set_exit_on_idle(). When it has closed all rings though that barrier is gone. Add the barrier after the set_bit().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-99243
EUVD
EUVD-2026-115773

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux 4b4e5bbf9386d4ec21d91c0cb0fd60b9bba778ec
Linux Linux 71a85387546e50b1a37b0fa45dadcae3bfb35cf6
Linux Linux 71a85387546e50b1a37b0fa45dadcae3bfb35cf6
Linux Linux 71a85387546e50b1a37b0fa45dadcae3bfb35cf6
Linux Linux 71a85387546e50b1a37b0fa45dadcae3bfb35cf6
Linux Linux 71a85387546e50b1a37b0fa45dadcae3bfb35cf6
Linux Linux 71a85387546e50b1a37b0fa45dadcae3bfb35cf6
Linux Linux 5.15.11
Linux Linux 5.16

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a race condition in the Linux kernel's io-wq (I/O workqueue) subsystem. It involves improper memory ordering between setting an exit bit and canceling task work for worker creation. On weakly ordered architectures, the exiting task may not see the exit bit set before checking task work, causing the worker creation to remain queued indefinitely. This leads to a deadlock where the exiting task waits for worker completion that never happens.

Detection Guidance

This vulnerability is specific to the Linux kernel's io-wq subsystem and requires kernel-level inspection. Detection involves checking kernel logs for io_uring-related hangs or worker creation issues. Use commands like dmesg | grep io_uring or journalctl -k | grep io_wq to identify abnormal behavior. No direct network detection commands are applicable.

Impact Analysis

This vulnerability can cause system hangs or crashes on affected Linux systems using io_uring. Specifically, tasks using io_uring may become unresponsive or deadlock, requiring a system reboot to recover. It primarily affects systems with weakly ordered memory architectures running recent Linux kernels.

Mitigation Strategies

Apply the latest kernel patch from your Linux distribution to resolve the io-wq ordering issue. If immediate patching is not possible, consider disabling io_uring features temporarily by setting kernel parameters like io_uring=0 or disabling related services. Monitor system logs for hangs or deadlocks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-99243. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...