CVE-2026-23275 (GCVE-0-2026-23275)
Vulnerability from cvelistv5
Published
2026-03-20 08:08
Modified
2026-10-19 18:35
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: io_uring: ensure ctx->rings is stable for task work flags manipulation If DEFER_TASKRUN | SETUP_TASKRUN is used and task work is added while the ring is being resized, it's possible for the OR'ing of IORING_SQ_TASKRUN to happen in the small window of swapping into the new rings and the old rings being freed. Prevent this by adding a 2nd ->rings pointer, ->rings_rcu, which is protected by RCU. The task work flags manipulation is inside RCU already, and if the resize ring freeing is done post an RCU synchronize, then there's no need to add locking to the fast path of task work additions. Note: this is only done for DEFER_TASKRUN, as that's the only setup mode that supports ring resizing. If this ever changes, then they too need to use the io_ctx_mark_taskrun() helper.
References
Impacted products
Vendor Product Version
Linux Linux Version: 79cfe9e59c2a12c3b3faeeefe38d23f3d8030972
Version: 79cfe9e59c2a12c3b3faeeefe38d23f3d8030972
Version: 79cfe9e59c2a12c3b3faeeefe38d23f3d8030972
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23275",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:07:18.790860Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T18:35:41.307Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/io_uring_types.h",
            "io_uring/io_uring.c",
            "io_uring/register.c",
            "io_uring/tw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7cc4530b3e952d4a5947e1e55d06620d8845d4f5",
              "status": "affected",
              "version": "79cfe9e59c2a12c3b3faeeefe38d23f3d8030972",
              "versionType": "git"
            },
            {
              "lessThan": "46dc07d5f31411cc023f3bf1f4a23a07bf6e0ed1",
              "status": "affected",
              "version": "79cfe9e59c2a12c3b3faeeefe38d23f3d8030972",
              "versionType": "git"
            },
            {
              "lessThan": "96189080265e6bb5dde3a4afbaf947af493e3f82",
              "status": "affected",
              "version": "79cfe9e59c2a12c3b3faeeefe38d23f3d8030972",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/io_uring_types.h",
            "io_uring/io_uring.c",
            "io_uring/register.c",
            "io_uring/tw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.19",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.9",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: ensure ctx-\u003erings is stable for task work flags manipulation\n\nIf DEFER_TASKRUN | SETUP_TASKRUN is used and task work is added while\nthe ring is being resized, it\u0027s possible for the OR\u0027ing of\nIORING_SQ_TASKRUN to happen in the small window of swapping into the\nnew rings and the old rings being freed.\n\nPrevent this by adding a 2nd -\u003erings pointer, -\u003erings_rcu, which is\nprotected by RCU. The task work flags manipulation is inside RCU\nalready, and if the resize ring freeing is done post an RCU synchronize,\nthen there\u0027s no need to add locking to the fast path of task work\nadditions.\n\nNote: this is only done for DEFER_TASKRUN, as that\u0027s the only setup mode\nthat supports ring resizing. If this ever changes, then they too need to\nuse the io_ctx_mark_taskrun() helper."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - io_uring is accessed via the io_uring_setup and io_uring_register syscalls, requiring local system access.\nAC:L - The attacker controls both sides of the race \u2014 they trigger ring resize while simultaneously causing task work additions. DEFER_TASKRUN+SINGLE_ISSUER means a single task, but completions adding task work happen concurrently with the register syscall.\nPR:L - io_uring is accessible to unprivileged local users by default (sysctl_io_uring_disabled defaults to 0, no capabilities required).\nUI:N - No user interaction is needed; the attacker can set up the io_uring ring with DEFER_TASKRUN and trigger the race entirely on their own.\nS:U - The vulnerability stays within the kernel security boundary; no VM escape or sandbox bypass is involved.\nC:H - This is a use-after-free on the rings structure. The freed memory can be reallocated with attacker-controlled data, potentially enabling arbitrary kernel memory reads.\nI:H - The UAF allows atomic_or on freed/reallocated memory, enabling heap spraying and arbitrary write primitives that could lead to code execution.\nA:H - Accessing freed memory (use-after-free) can cause kernel crashes/oops, and the race can be triggered repeatedly for reliable denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:21:06.046Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7cc4530b3e952d4a5947e1e55d06620d8845d4f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/46dc07d5f31411cc023f3bf1f4a23a07bf6e0ed1"
        },
        {
          "url": "https://git.kernel.org/stable/c/96189080265e6bb5dde3a4afbaf947af493e3f82"
        }
      ],
      "title": "io_uring: ensure ctx-\u003erings is stable for task work flags manipulation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23275",
    "datePublished": "2026-03-20T08:08:55.857Z",
    "dateReserved": "2026-01-13T15:37:45.991Z",
    "dateUpdated": "2026-10-19T18:35:41.307Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T12:21:06.046Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nio_uring: ensure ctx-\u003erings is stable for task work flags manipulation\\n\\nIf DEFER_TASKRUN | SETUP_TASKRUN is used and task work is added while\\nthe ring is being resized, it\u0027s possible for the OR\u0027ing of\\nIORING_SQ_TASKRUN to happen in the small window of swapping into the\\nnew rings and the old rings being freed.\\n\\nPrevent this by adding a 2nd -\u003erings pointer, -\u003erings_rcu, which is\\nprotected by RCU. The task work flags manipulation is inside RCU\\nalready, and if the resize ring freeing is done post an RCU synchronize,\\nthen there\u0027s no need to add locking to the fast path of task work\\nadditions.\\n\\nNote: this is only done for DEFER_TASKRUN, as that\u0027s the only setup mode\\nthat supports ring resizing. If this ever changes, then they too need to\\nuse the io_ctx_mark_taskrun() helper.\"}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - io_uring is accessed via the io_uring_setup and io_uring_register syscalls, requiring local system access.\\nAC:L - The attacker controls both sides of the race \\u2014 they trigger ring resize while simultaneously causing task work additions. DEFER_TASKRUN+SINGLE_ISSUER means a single task, but completions adding task work happen concurrently with the register syscall.\\nPR:L - io_uring is accessible to unprivileged local users by default (sysctl_io_uring_disabled defaults to 0, no capabilities required).\\nUI:N - No user interaction is needed; the attacker can set up the io_uring ring with DEFER_TASKRUN and trigger the race entirely on their own.\\nS:U - The vulnerability stays within the kernel security boundary; no VM escape or sandbox bypass is involved.\\nC:H - This is a use-after-free on the rings structure. The freed memory can be reallocated with attacker-controlled data, potentially enabling arbitrary kernel memory reads.\\nI:H - The UAF allows atomic_or on freed/reallocated memory, enabling heap spraying and arbitrary write primitives that could lead to code execution.\\nA:H - Accessing freed memory (use-after-free) can cause kernel crashes/oops, and the race can be triggered repeatedly for reliable denial of service.\"}]}], \"affected\": [{\"product\": \"Linux\", \"vendor\": \"Linux\", \"defaultStatus\": \"unaffected\", \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"programFiles\": [\"include/linux/io_uring_types.h\", \"io_uring/io_uring.c\", \"io_uring/register.c\", \"io_uring/tw.c\"], \"versions\": [{\"version\": \"79cfe9e59c2a12c3b3faeeefe38d23f3d8030972\", \"lessThan\": \"7cc4530b3e952d4a5947e1e55d06620d8845d4f5\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"79cfe9e59c2a12c3b3faeeefe38d23f3d8030972\", \"lessThan\": \"46dc07d5f31411cc023f3bf1f4a23a07bf6e0ed1\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"79cfe9e59c2a12c3b3faeeefe38d23f3d8030972\", \"lessThan\": \"96189080265e6bb5dde3a4afbaf947af493e3f82\", \"status\": \"affected\", \"versionType\": \"git\"}]}, {\"product\": \"Linux\", \"vendor\": \"Linux\", \"defaultStatus\": \"affected\", \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"programFiles\": [\"include/linux/io_uring_types.h\", \"io_uring/io_uring.c\", \"io_uring/register.c\", \"io_uring/tw.c\"], \"versions\": [{\"version\": \"6.13\", \"status\": \"affected\"}, {\"version\": \"0\", \"lessThan\": \"6.13\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"6.18.19\", \"lessThanOrEqual\": \"6.18.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"6.19.9\", \"lessThanOrEqual\": \"6.19.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"7.0\", \"lessThanOrEqual\": \"*\", \"status\": \"unaffected\", \"versionType\": \"original_commit_for_fix\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.13\", \"versionEndExcluding\": \"6.18.19\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.13\", \"versionEndExcluding\": \"6.19.9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.13\", \"versionEndExcluding\": \"7.0\"}]}]}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/7cc4530b3e952d4a5947e1e55d06620d8845d4f5\"}, {\"url\": \"https://git.kernel.org/stable/c/46dc07d5f31411cc023f3bf1f4a23a07bf6e0ed1\"}, {\"url\": \"https://git.kernel.org/stable/c/96189080265e6bb5dde3a4afbaf947af493e3f82\"}], \"title\": \"io_uring: ensure ctx-\u003erings is stable for task work flags manipulation\", \"x_generator\": {\"engine\": \"bippy-1.2.0\"}}, \"adp\": [{\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-23275\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-16T15:07:18.790860Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-362\", \"description\": \"CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-16T15:07:19.543Z\"}, \"title\": \"CISA ADP Vulnrichment\"}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-23275\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"Linux\", \"dateReserved\": \"2026-01-13T15:37:45.991Z\", \"datePublished\": \"2026-03-20T08:08:55.857Z\", \"dateUpdated\": \"2026-10-19T18:35:41.307Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.