CVE-2026-64425

Analyzed Analyzed - Analysis Complete

Linux Kernel io_uring IO_WQ_BIT_EXIT Race Condition

Publication date: 2026-07-25

Last updated on: 2026-09-08

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item commit 10dc95939817 ("io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop") fixed the obvious case where io_worker_handle_work() took one exit-bit snapshot before draining pending work, but the fix stops one level too early. io_worker_handle_work() now re-checks IO_WQ_BIT_EXIT in its outer work run loop, yet it still snapshots that bit once before processing a whole dependent linked-work chain. If io_wq_exit_start() sets IO_WQ_BIT_EXIT after the first linked item has started, the remaining linked items can still reuse stale do_kill = false, skip IO_WQ_WORK_CANCEL, and continue running after exit has begun. Move the check further inside, so it covers linked items too. Note: this is a syzbot special as it loves setting up tons of slow linked work on weird devices like msr that take forever to read, and immediately close the ring. Exit then takes a long time.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-09-08

Generated

2026-09-24

AI Q&A

2026-07-25

EPSS Evaluated

2026-09-23

NVD

CVE-2026-64425

EUVD

EUVD-2026-48769

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	From 5.10.253 (inc) to 5.10.261 (exc)
linux	linux_kernel	From 5.15.203 (inc) to 5.15.212 (exc)
linux	linux_kernel	From 6.1.167 (inc) to 6.1.178 (exc)
linux	linux_kernel	From 6.12.68 (inc) to 6.12.96 (exc)
linux	linux_kernel	From 6.18.8 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.19.1 (inc) to 7.1.4 (exc)
linux	linux_kernel	From 6.6.122 (inc) to 6.6.145 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of exit conditions in io_uring's work queue system. The issue occurs when the system fails to re-check the exit status for each linked work item during processing. This can allow work items to continue running even after an exit has been initiated, potentially leading to unexpected behavior or resource usage.

Detection Guidance

This vulnerability is specific to the Linux kernel's io_uring/io-wq subsystem and requires kernel-level inspection. Detection involves checking kernel logs for io_uring-related errors or monitoring for unusual linked work item behavior. Commands like dmesg, journalctl -k, or checking /proc/kmsg may reveal related errors. No direct network detection commands are applicable.

Impact Analysis

If exploited, this vulnerability could allow an attacker to cause a denial of service by preventing proper cleanup of work items. It may also lead to resource exhaustion or unexpected system behavior due to lingering work items running after an exit is requested.

Compliance Impact

This vulnerability in the Linux kernel's io_uring/io-wq subsystem does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level kernel issue related to work item handling during exit conditions, not data privacy or security controls.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this vulnerability. Monitor kernel updates from your distribution and apply them promptly.

Hi! I’m here to help you understand CVE-2026-64425. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70