PT-2026-64646 · Linux · Linux
CVE-2026-64425
·
Publicado
2026-07-25
·
Atualizado
2026-07-25
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
io uring/io-wq: re-check IO WQ BIT EXIT for each linked work item
commit 10dc95939817 ("io uring/io-wq: check IO WQ BIT EXIT inside work
run loop") fixed the obvious case where io worker handle work() took one
exit-bit snapshot before draining pending work, but the fix stops one
level too early.
io worker handle work() now re-checks IO WQ BIT EXIT in its outer work
run loop, yet it still snapshots that bit once before processing a whole
dependent linked-work chain. If io wq exit start() sets IO WQ BIT EXIT
after the first linked item has started, the remaining linked items can
still reuse stale do kill = false, skip IO WQ WORK CANCEL, and continue
running after exit has begun.
Move the check further inside, so it covers linked items too. Note: this
is a syzbot special as it loves setting up tons of slow linked work on
weird devices like msr that take forever to read, and immediately close
the ring. Exit then takes a long time.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux