CVE-2026-23113
io_uring io-wq Exit Loop Hang Causing Kernel Task Block
Publication date: 2026-02-14
Last updated on: 2026-04-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 5.12 |
| linux | linux_kernel | 5.12 |
| linux | linux_kernel | 5.12 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.7 (inc) to 6.12.68 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.8 (exc) |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 5.12.1 (inc) to 6.6.122 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the Linux kernel's io_uring subsystem, specifically the io-wq (I/O workqueue) component. The issue is that the system does not check the IO_WQ_BIT_EXIT flag inside the work run loop, which can cause the io-wq to take an excessively long time to exit when processing large read operations on /dev/msr* files.
The problem arises because /dev/msr* files do not support the read_iter() method, so the loop_rw_iter() function handles the reads, each returning 16MB of data and taking about 20 seconds. When many such reads are queued, processing them all can take longer than the system's uninterruptible sleep timeout, causing the task to be blocked for an extended period.
The fix involves checking the IO_WQ_BIT_EXIT flag inside the io_worker_handle_work() loop, allowing the system to cancel remaining work items early and speed up the exit process.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel's io-wq worker threads to become blocked for a very long time when processing large read requests on certain device files, such as /dev/msr*. This can lead to system performance degradation or delays in task completion.
Specifically, tasks may be stuck in an uninterruptible sleep state for over two minutes, which could affect system responsiveness and stability, especially under heavy I/O workloads involving these device files.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by observing if tasks related to io_uring/io-wq are blocked for an unusually long time, specifically more than 140 seconds, which triggers a kernel hung task timeout message.
A typical indication is a kernel log message similar to: "INFO: task syz.4.135:6326 blocked for more than 143 seconds." This message shows that the io-wq worker is stuck processing large reads from /dev/msr* files.
To detect this on your system, you can monitor kernel logs for hung task warnings related to io_uring or io-wq workers.
There are no specific commands provided in the context to detect this vulnerability directly.
What immediate steps should I take to mitigate this vulnerability?
An immediate mitigation step is to disable the kernel hung task timeout message by running the command: echo 0 > /proc/sys/kernel/hung_task_timeout_secs
This will prevent the kernel from complaining about tasks blocked for more than the default timeout (140 seconds), which is triggered by the long processing time of large reads in io-wq.
However, this does not fix the underlying issue but avoids the complaint message.
The permanent fix involves a kernel update that changes the io_worker_handle_work() loop to check IO_WQ_BIT_EXIT more frequently, allowing io-wq to cancel pending work faster and avoid long blocking.
Therefore, applying the updated Linux kernel patch that resolves this issue is the recommended long-term mitigation.