io_uring: ensure ctx->rings is stable for task work flags manipulation
In the Linux kernel, the following vulnerability has been resolved: io_uring: ensure ctx->rings is stable for task work flags manipulation If DEFER_TASKRUN | SETUP_TASKRUN is used and task work is added while the ring is being resized, it's possible for the OR'ing of IORING_SQ_TASKRUN to happen in the small window of swapping into the new rings and the old rings being freed. Prevent this by adding a 2nd ->rings pointer, ->rings_rcu, which is protected by RCU. The task work flags manipulation is inside RCU already, and if the resize ring freeing is done post an RCU synchronize, then there's no need to add locking to the fast path of task work additions. Note: this is only done for DEFER_TASKRUN, as that's the only setup mode that supports ring resizing. If this ever changes, then they too need to use the io_ctx_mark_taskrun() helper.
CVE-2026-23275
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-23275
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "79cfe9e59c2a12c3b3faeeefe38d23f3d8030972",
"lessThan": "7cc4530b3e952d4a5947e1e55d06620d8845d4f5",
"versionType": "git"
},
{
"status": "affected",
"version": "79cfe9e59c2a12c3b3faeeefe38d23f3d8030972",
"lessThan": "46dc07d5f31411cc023f3bf1f4a23a07bf6e0ed1",
"versionType": "git"
},
{
"status": "affected",
"version": "79cfe9e59c2a12c3b3faeeefe38d23f3d8030972",
"lessThan": "96189080265e6bb5dde3a4afbaf947af493e3f82",
"versionType": "git"
}
],
"programFiles": [
"include/linux/io_uring_types.h",
"io_uring/io_uring.c",
"io_uring/register.c",
"io_uring/tw.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.13",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver",
"lessThanOrEqual": "6.19.*"
},
{
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"include/linux/io_uring_types.h",
"io_uring/io_uring.c",
"io_uring/register.c",
"io_uring/tw.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-23275
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #39835 · Revision 1
- Added to Heist Feed
- Publisher date