Cloudanix VulnDB

CVE-2026-99268

None

CVSS

—

EPSS

0.2%

Published

Nov 3, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel can stop certain high-speed input-output programs from noticing when their work is finished, causing them to wait longer than they should.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw prevents io_uring from waking pollers on the ring file descriptor when local task_work is first queued under IORING_SETUP_DEFER_TASKRUN; poll/epoll therefore reports no pending events even though completions exist, because the wake was moved from io_req_local_work_add to the later CQE commit path.

Why it matters to the business

Applications relying on io_uring with deferred task completion and event-driven polling may stall or lose responsiveness until an unrelated kernel entry occurs, degrading throughput and potentially causing service outages in high-performance I/O workloads.

How an attack unfolds

An attacker supplies I/O requests that trigger local task_work on a DEFER_TASKRUN ring; because poll_wq is not signaled, a waiting poller sleeps indefinitely or until an external event forces the submitter back into the kernel, enabling denial-of-service or delayed processing.

How to fix it

Update the Linux kernel to a version containing the fix that wakes poll_wq (via direct wake or RCU callback) when the first local work item is added; rebuild and reboot affected systems or apply the vendor-supplied backport.

How to confirm the fix worked

Confirm the kernel source contains the io_req_local_work_add wake logic for poll_wq; run regression tests exercising DEFER_TASKRUN rings with poll/epoll waiters and verify that poll events are delivered promptly after local work is queued.

Typical attack path

  1. Create io_uring instance with IORING_SETUP_DEFER_TASKRUN
  2. Register ring file descriptor with poll or epoll
  3. Submit requests that queue local work without immediate CQE commit
  4. Observe that poll returns no events and the waiting task remains blocked

How to detect it

Inspect kernel logs and application traces for processes blocked inside io_uring_poll or ep_poll on ring file descriptors while DEFER_TASKRUN rings have pending local work; correlate with strace or perf showing missing wakeups on poll_wq.

What your security team should do

  • Prioritize kernel updates on systems using io_uring with DEFER_TASKRUN and event polling
  • Audit user-space code for reliance on poll/epoll of ring fds under deferred taskrun
  • Monitor kernel changelogs for stable-branch backports of the wake-up fix

The record

In the Linux kernel, the following vulnerability has been resolved: io_uring: wake ring pollers for local task_work With IORING_SETUP_DEFER_TASKRUN completions are queued as local work, and only become CQEs when the submitter enters the kernel to wait for events. For an application that finds out via poll() or epoll on the ring fd when it is time to do that, io_uring_poll() reports EPOLLIN if local work is pending. That only helps if the work is there at the time of the call. When DEFER_TASKRUN was added, io_req_local_work_add() did io_cqring_wake(), which took care of tasks sleeping in poll() as well. Then polling got a wait queue of its own, ->poll_wq, and the wake up in io_req_local_work_add() was replaced by waking the submitter directly. Since then ->poll_wq is only woken when CQEs are committed, which for such a ring is done by the very task that is waiting to be told to: submitter completion poll(ring_fd) io_uring_poll() // nothing yet schedule() io_req_local_work_add() // ->cq_wait_nr: nobody waits // sleeps on Wake ->poll_wq when the first entry is put on the work list. Like for the eventfd, that must not be done right away if the work is queued from a wake up handler, as the chain of wake ups could get back to the wait queue whose lock is held. Use an RCU callback in that case, with a reference to the ring.

Affected packages

Ecosystem Package Introduced Fixed