CVE-2026-98858
Received Received - Intake

Use-After-Free in Linux Kernel io_uring SQPOLL

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix task_work add use-after-free with SQPOLL For SQPOLL, the sqpoll thread runs task_work off its own list and doesn't need to be told about it, so it can pop and complete a request as soon as mpscq_push() has published it. If that was the last request holding the ring alive, io_ring_exit_work() then frees the ctx, stops the thread, and with it the tctx, while io_req_normal_work_add() is still looking at both after the push: BUG: KASAN: slab-use-after-free in io_req_normal_work_add+0x439/0x510 Read of size 4 at addr ff11000000ca0000 by task repro/55 (...) BUG: KASAN: slab-use-after-free in queue_work_on+0x25/0x70 Write of size 8 at addr ff11000000c3bd00 by task repro/55 Hold an RCU read lock across the add, like io_req_local_work_add() already does, and have io_ring_exit_work() wait for a grace period for SQPOLL rings as well before freeing the ctx.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98858
EUVD
EUVD-2026-103798

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux af5d68f8892f8ee8f137648b79ceb2abc153a19b
Linux Linux af5d68f8892f8ee8f137648b79ceb2abc153a19b
Linux Linux af5d68f8892f8ee8f137648b79ceb2abc153a19b
Linux Linux af5d68f8892f8ee8f137648b79ceb2abc153a19b
Linux Linux 6.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a use-after-free issue in the io_uring subsystem when using SQPOLL mode. The sqpoll thread processes task_work from its own list and can complete a request immediately after it is published. If this request was the last one keeping the ring alive, the io_ring_exit_work() function frees the context and stops the thread, potentially causing a use-after-free when io_req_normal_work_add() accesses freed memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's io_uring subsystem and may not have direct network detection methods. Check kernel logs for KASAN errors or slab-use-after-free messages related to io_req_normal_work_add or queue_work_on. Commands like dmesg | grep -i "KASAN\|use-after-free\|io_uring" may help identify affected systems.

Impact Analysis

This vulnerability could lead to system crashes, data corruption, or privilege escalation if exploited. It may allow an attacker to execute arbitrary code or cause denial-of-service conditions on affected systems running vulnerable Linux kernel versions with io_uring enabled.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this io_uring issue. Monitor kernel security advisories and apply updates promptly. If immediate patching is not possible, consider disabling io_uring features if they are not critical to system operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98858. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart