Live › vulnerability › CVE-2026-98858
Go to dashboardIn the Linux kernel's io_uring subsystem, the SQPOLL thread can complete a request while the ring is being torn down, so the add path reads freed memory. The sources describe a KASAN-reported use-after-free; the text does not state what an attacker can achieve beyond a kernel memory fault.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with io_uring and SQPOLL rings are in scope, since the flaw sits on the SQPOLL teardown path. The sources do not say which kernel versions are affected, whether unprivileged users can reach the path, or whether default configurations enable it.
No product ranges from the sources yet.
uname -r and compare against the kernel version that carries the fix, which the sources do not name.grep -r IORING_SETUP_SQPOLL in the application source, or cat /proc/sys/kernel/io_uring_disabled.sysctl kernel.io_uring_disabled=2 (unknown whether the sources endorse this).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
io_uring: fix task_work add use-after-free with SQPOLL
For SQPOLL, the sqpoll thread runs task_work off its own list and doesn't need to be told about it, so it can pop and complete a request as soon as mpscq_push() has published it. If that was the last request holding the ring alive, io_ring_exit_work() then frees the ctx, stops the thread, and with it the tctx, while io_req_normal_work_add() is still looking at both after the push:
BUG: KASAN: slab-use-after-free in io_req_normal_work_add+0x439/0x510 Read of size 4 at addr ff11000000ca0000 by task repro/55 (...) BUG: KASAN: slab-use-after-free in queue_work_on+0x25/0x70 Write of size 8 at addr ff11000000c3bd00 by task repro/55
Hold an RCU read lock across the add, like io_req_local_work_add() already does, and have io_ring_exit_work() wait for a grace period for SQPOLL rings as well before freeing the ctx.
This page as .md · .json · in your agent: get_signal("CVE-2026-98858")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.