CVE-2026-80920

Received Received - Intake

Linux Kernel io_uring Eventfd Signaling Race Condition

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: io_uring: defer eventfd signaling when queued from a wakeup handler io_req_local_work_add() signals the CQ ring eventfd inline when it is the one to push the first entry onto ->work_list. For DEFER_TASKRUN rings that add is frequently done from a waitqueue wakeup handler, where an arbitrary waitqueue lock is held. eventfd_signal_mask() only refuses to recurse when current->in_eventfd is set, but that bit is set by eventfd_signal_mask() itself. If the wake chain starts somewhere else, signal goes out inline and can feed back into epoll. Add IOU_F_TWQ_IN_WAKE, set it on the task_work add done from the three waitqueue callbacks, and use it to force io_eventfd_signal() down the existing call_rcu_hurry() deferral instead of signaling inline.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-09

Generated

2026-09-11

AI Q&A

2026-09-10

EPSS Evaluated

N/A

NVD

CVE-2026-80920

EUVD

EUVD-2026-75095

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper signaling in the io_uring subsystem. When a task is added to the work queue from a wakeup handler, it can trigger eventfd signaling inline. This may lead to recursive eventfd calls, especially if the wake chain starts elsewhere, potentially causing issues with epoll and other event handling mechanisms.

Detection Guidance

This vulnerability is specific to the Linux kernel's io_uring subsystem and does not have direct detection commands provided in the context. Monitoring for unusual eventfd signaling patterns or kernel crashes related to io_uring may be necessary. Check kernel logs for io_uring-related errors or warnings using dmesg or journalctl.

Impact Analysis

The vulnerability could lead to unexpected behavior in applications using io_uring, such as hangs or crashes due to recursive eventfd signaling. It may also cause performance degradation or instability in systems relying on event-driven I/O operations.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a Linux kernel io_uring issue involving eventfd signaling. No evidence suggests data breaches or unauthorized access risks that would impact regulatory compliance.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the io_uring eventfd signaling issue. Monitor kernel security advisories for updates and apply patches promptly.

Hi! I’m here to help you understand CVE-2026-80920. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70