{"id":"CVE-2026-98858","kind":"vulnerability","aliases":["CVE-2026-98858"],"related":[],"title":"Linux kernel io_uring: SQPOLL task_work use-after-free on ring teardown","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: fix task_work add use-after-free with SQPOLL\n\nFor SQPOLL, the sqpoll thread runs task_work off its own list and\ndoesn't need to be told about it, so it can pop and complete a request\nas soon as mpscq_push() has published it. If that was the last request\nholding the ring alive, io_ring_exit_work() then frees the ctx, stops\nthe thread, and with it the tctx, while io_req_normal_work_add() is\nstill looking at both after the push:\n\n  BUG: KASAN: slab-use-after-free in io_req_normal_work_add+0x439/0x510\n  Read of size 4 at addr ff11000000ca0000 by task repro/55\n  (...)\n  BUG: KASAN: slab-use-after-free in queue_work_on+0x25/0x70\n  Write of size 8 at addr ff11000000c3bd00 by task repro/55\n\nHold an RCU read lock across the add, like io_req_local_work_add() already\ndoes, and have io_ring_exit_work() wait for a grace period for SQPOLL rings\nas well before freeing the ctx.","summary":"In the Linux kernel's io_uring subsystem, the SQPOLL thread can complete a request while the ring is being torn down, so the add path reads freed memory. The sources describe a KASAN-reported use-after-free; the text does not state what an attacker can achieve beyond a kernel memory fault.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["io-uring","linux-kernel","runtime","self-hosted"],"not_affected_if":["io-uring-disabled","no-sqpoll-rings"],"how_to_check":"- Run `uname -r` and compare against the kernel version that carries the fix, which the sources do not name.\n- Check whether io_uring is in use with SQPOLL rings, for example with `grep -r IORING_SETUP_SQPOLL` in the application source, or `cat /proc/sys/kernel/io_uring_disabled`.","fix":"- Update the Linux kernel to a release that includes the upstream commit fixing io_uring task_work add with SQPOLL; the sources do not give the version number, so unknown.\n- If io_uring is not needed, set `sysctl kernel.io_uring_disabled=2` (unknown whether the sources endorse this).","status":"open","published_at":"2026-10-18T16:17:40+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:12:57+00:00","updated_at":"2026-10-25T05:12:57+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:12:57Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit fixing io_uring task_work add with SQPOLL; the sources do not give the version number, so unknown.\n- If io_uring is not needed, set `sysctl kernel.io_uring_disabled=2` (unknown whether the sources endorse this).","reach":"local","title":"Linux kernel io_uring: SQPOLL task_work use-after-free on ring teardown","impact":"high","summary":"In the Linux kernel's io_uring subsystem, the SQPOLL thread can complete a request while the ring is being torn down, so the add path reads freed memory. The sources describe a KASAN-reported use-after-free; the text does not state what an attacker can achieve beyond a kernel memory fault.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","io-uring","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel memory corruption from a use-after-free, possibly code execution","analyst_note":"Check the upstream kernel commit and stable backports for affected and fixed version ranges, and confirm whether unprivileged local users can create SQPOLL rings.","how_to_check":"- Run `uname -r` and compare against the kernel version that carries the fix, which the sources do not name.\n- Check whether io_uring is in use with SQPOLL rings, for example with `grep -r IORING_SETUP_SQPOLL` in the application source, or `cat /proc/sys/kernel/io_uring_disabled`.","needs_analyst":true,"not_affected_if":["no-sqpoll-rings","io-uring-disabled"],"who_is_affected":"Systems running a Linux kernel with io_uring and SQPOLL rings are in scope, since the flaw sits on the SQPOLL teardown path. The sources do not say which kernel versions are affected, whether unprivileged users can reach the path, or whether default configurations enable it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000713,"input_tokens":3598,"output_tokens":707,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':198C,221C '-2026':16A,19A '-98858':17A,20A '4':203C '8':226C 'achiev':80B 'across':238C 'add':55B,101C,176C,197C,240C,246C 'addr':205C,228C 'aliv':154C 'alreadi':247C 'attack':78B 'beyond':81B 'bug':185C,210C 'complet':43B,134C 'ctx':162C,268C 'cve':15A,18A 'describ':62B 'doesn':121C 'exit':157C,253C 'fault':85B 'ff11000000c3bd00':229C 'ff11000000ca0000':206C 'fix':98C 'follow':91C 'free':11A,70B,105C,160C,191C,216C,266C 'freed':58B 'grace':258C 'hold':151C,233C 'host':30B 'io':3A,22B,36B,96C,155C,172C,193C,242C,251C 'io-ur':21B 'kasan':65B,186C,211C 'kasan-report':64B 'kernel':2A,26B,34B,83B,89C 'last':149C 'like':241C 'linux':1A,25B,33B,88C 'linux-kernel':24B 'list':119C 'local':244C 'lock':237C 'look':179C 'memori':59B,84B 'mpscq':140C 'need':123C 'normal':174C,195C 'path':56B 'period':259C 'pop':132C 'publish':143C 'push':141C,184C 'queue':218C 'rcu':235C 'read':57B,200C,236C 'report':66B 'repro/55':209C,232C 'req':173C,194C,243C 'request':45B,136C,150C 'resolv':95C 'ring':13A,48B,153C,156C,252C,262C 'run':113C 'runtim':27B 'self':29B 'self-host':28B 'size':202C,225C 'slab':188C,213C 'slab-use-after-fre':187C,212C 'soon':138C 'sourc':61B 'sqpoll':5A,40B,107C,109C,111C,261C 'state':75B 'still':178C 'stop':163C 'subsystem':38B 'task':6A,99C,114C,208C,231C 'tctx':170C 'teardown':14A 'text':72B 'thread':41B,112C,165C 'told':126C 'torn':51B 'ure':4A,23B,37B,97C 'use':9A,68B,103C,189C,214C 'use-after-fre':8A,67B,102C 'vulner':92C 'wait':255C 'well':264C 'work':7A,100C,115C,158C,175C,196C,219C,245C,254C 'write':223C 'x25/0x70':222C 'x439/0x510':199C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with io_uring and SQPOLL rings are in scope, since the flaw sits on the SQPOLL teardown path. The sources do not say which kernel versions are affected, whether unprivileged users can reach the path, or whether default configurations enable it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:40+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98858","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98858","severity":null,"published_at":"2026-10-18T16:17:40+00:00","modified_at":"2026-10-19T10:19:49+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}