PT-2026-64646 · Linux · Linux
CVE-2026-64425
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
io uring/io-wq: re-check IO WQ BIT EXIT for each linked work item
commit 10dc95939817 ("io uring/io-wq: check IO WQ BIT EXIT inside work
run loop") fixed the obvious case where io worker handle work() took one
exit-bit snapshot before draining pending work, but the fix stops one
level too early.
io worker handle work() now re-checks IO WQ BIT EXIT in its outer work
run loop, yet it still snapshots that bit once before processing a whole
dependent linked-work chain. If io wq exit start() sets IO WQ BIT EXIT
after the first linked item has started, the remaining linked items can
still reuse stale do kill = false, skip IO WQ WORK CANCEL, and continue
running after exit has begun.
Move the check further inside, so it covers linked items too. Note: this
is a syzbot special as it loves setting up tons of slow linked work on
weird devices like msr that take forever to read, and immediately close
the ring. Exit then takes a long time.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux