CVE-2026-97619

Received Received - Intake

Linux kernel io_uring Write Accounting Race Condition

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: io_uring/rw: end write accounting from ->ki_complete Commit b000145e9907 moved both the fsnotify calls and the write accounting out of the kiocb completion handler and into the io_req_rw_complete() task_work. However, only the fsnotify part actually needed to move as it may sleep. Ending the write accounting is just a percpu_up_read() on the superblock writers sem. Deferring it is a problem, because it makes dropping SB_FREEZE_WRITE protection depend on the ring owner getting to running task_work. But the task may be blocked in freeze_super(), causing it to never get to that: task io-wq worker -------------------------------------------------------------- io_write() io_kiocb_start_write() (takes sb_writers, hidden from lockdep by __sb_writers_release) write_iter() -> -EIOCBQUEUED ioctl(FS_IOC_SHUTDOWN) bdev_freeze() freeze_super() percpu_down_write() <- waits for the reader above io_write() kiocb_start_write() percpu_down_read() <- queued behind the writer <bio completes> io_complete_rw() queues io_req_rw_complete() <- never runs, task is in D state End the write from io_complete_rw() instead, and leave only the fsnotify calls in task_work.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-97619

EUVD

EUVD-2026-86750

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of write accounting in the io_uring subsystem. A commit moved write accounting to a task_work handler, but this caused issues because it delayed the release of a semaphore protecting filesystem writes. This delay can block critical operations like filesystem freezing, leading to deadlocks where tasks wait indefinitely for each other.

Detection Guidance

This vulnerability is specific to the Linux kernel's io_uring subsystem and does not have direct network detection methods. Detection involves checking the kernel version and io_uring implementation. Use commands like 'uname -a' to check the kernel version and 'grep -r CONFIG_IO_URING /boot/config-$(uname -r)' to verify io_uring support. If the kernel is vulnerable, it will likely be an older version before the fix in commit b000145e9907.

Impact Analysis

This vulnerability can cause system hangs or crashes when specific I/O operations and filesystem freezing are attempted simultaneously. It may lead to unresponsive systems, data corruption risks, or denial-of-service conditions if exploited or triggered under certain workloads.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a Linux kernel issue related to io_uring write accounting and task_work scheduling. Compliance impacts would depend on system configuration and usage rather than the vulnerability itself.

Mitigation Strategies

Immediately update the Linux kernel to a version that includes the fix for this vulnerability (commit b000145e9907 or later). If updating is not immediately possible, consider disabling io_uring by setting 'CONFIG_IO_URING=n' in the kernel configuration and recompiling. Avoid using io_uring operations until patched.

Hi! I’m here to help you understand CVE-2026-97619. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70