PT-2026-26580 · Linux · Linux Kernel

Published 2026-01-01 · Updated 2026-03-26 · CVE-2026-23275

Positive Technologies · (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains an issue within the io uring subsystem. Specifically, a condition exists where, if DEFER TASKRUN and SETUP TASKRUN are utilized concurrently with task work being added during ring resizing, a race condition can occur. This can lead to the unintended bitwise OR operation of IORING SQ TASKRUN during the transition between old and new rings, potentially causing instability. To address this, a second pointer, ->rings rcu, protected by RCU (Read-Copy-Update), is introduced. This ensures stability during task work flag manipulation. The fix is only applied to DEFER TASKRUN as it is the only setup mode supporting ring resizing. The io ctx mark taskrun() helper function may be required if this changes in the future.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-23275

Affected Products

Linux Kernel

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-23275 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23275 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-23275 · Vendor Advisory
• https://git.kernel.org/stable/c/46dc07d5f31411cc023f3bf1f4a23a07bf6e0ed1 · Note
• https://git.kernel.org/stable/c/7cc4530b3e952d4a5947e1e55d06620d8845d4f5 · Note
• https://twitter.com/nsg650/status/2037087476087718275 · Twitter Post
• https://git.kernel.org/stable/c/96189080265e6bb5dde3a4afbaf947af493e3f82 · Note
• https://twitter.com/CVEnew/status/2035627018285429227 · Twitter Post