{"id":"CVE-2026-99228","kind":"vulnerability","aliases":["CVE-2026-99228"],"related":[],"title":"Linux kernel: io_uring exit can hang a thread on a FIFO open","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/io-wq: don't lose the signal that ends work\n\nWhen a thread exits, only its tracked requests are cancelled. Then its\nio-wq is torn down. io_wq_exit_workers() signals every worker, to get it\nout of an interruptible sleep, and waits for all of them to exit. Before\nthey do, they go through the work that is left. Unbounded work is\ncancelled. Bounded work is run, as it is expected to end by itself.\n\nNot all of it does. An open has no file yet, so it counts as bounded, and\nthe open of a FIFO waits for the other end. That is what the signal is for.\nBut the workers are signalled once, and a worker that hasn't started the\nwork by then loses the signal:\n\n  io_wq_exit_workers()               io_worker_handle_work()\n    io_wq_worker_wake()\n      set TIF_NOTIFY_SIGNAL\n                                       io_assign_current_work()\n                                         io_run_task_work()\n                                           clear TIF_NOTIFY_SIGNAL\n                                       io_wq_submit_work()\n                                         fifo_open()\n                                           wait_for_partner()\n    wait_for_completion_timeout()\n\nThe thread never gets out of do_exit():\n\n  IORING_OP_OPENAT of a FIFO without a writer, IOSQE_ASYNC\n  exit of the thread that has submitted it\n\nhangs in more than 9 of 10 attempts (4 CPUs, KVM), until the process is\nkilled.\n\nSet TIF_NOTIFY_SIGNAL for bounded work that is started with IO_WQ_BIT_EXIT\nset. The bit is set before the workers are signalled, and it is tested\nafter the flag has been cleared, with clear_notify_signal() providing the\nbarrier. So either the flag stays, or the bit is seen.\n\nWork that is started while the io-wq exits is treated like work that is\nbeing run at that time: it isn't interrupted unless it waits\ninterruptibly.","summary":"A race in the Linux kernel's io_uring worker teardown can drop the wake-up signal sent to a worker that is starting a bounded open of a FIFO with no writer. The exiting thread then never leaves do_exit() and hangs until the process is killed.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["io_uring","linux-kernel","runtime"],"not_affected_if":["io_uring-disabled"],"how_to_check":"- `uname -r` to see the running kernel version\n- Check whether the host runs io_uring workloads (`IORING_OP_OPENAT` use or `io_uring` in application code)","fix":null,"status":"open","published_at":"2026-11-02T16:17:47+00:00","first_seen_at":"2026-11-02T16:24:05+00:00","triaged_at":"2026-11-02T16:26:53+00:00","updated_at":"2026-11-02T16:26:53+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-02T16:26:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: io_uring exit can hang a thread on a FIFO open","impact":"low","summary":"A race in the Linux kernel's io_uring worker teardown can drop the wake-up signal sent to a worker that is starting a bounded open of a FIFO with no writer. The exiting thread then never leaves do_exit() and hangs until the process is killed.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux-kernel","io_uring"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"a process hangs in exit; denial of service","analyst_note":"Find the affected and fixed kernel version ranges from the NVD entry and the upstream stable commit.","how_to_check":"- `uname -r` to see the running kernel version\n- Check whether the host runs io_uring workloads (`IORING_OP_OPENAT` use or `io_uring` in application code)","plain_action":"","needs_analyst":true,"not_affected_if":["io_uring-disabled"],"who_is_affected":"Systems running a Linux kernel with io_uring enabled, where a process submits OPENAT operations (with IOSQE_ASYNC) against a FIFO that may have no writer. The sources do not name affected kernel version ranges. unknown whether default configurations are exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000724,"input_tokens":4689,"output_tokens":511,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-99228':16A,19A '10':291C '4':293C '9':289C 'assign':234C 'async':276C 'attempt':292C 'barrier':342C 'bit':314C,318C,350C 'bound':52B,151C,178C,306C 'cancel':104C,150C 'clear':241C,335C,337C 'complet':256C 'count':176C 'cpus':294C 'current':235C 'cve':14A,17A 'drop':38B 'either':344C 'end':93C,160C,189C 'everi':118C 'exit':5A,61B,67B,98C,115C,135C,219C,265C,277C,315C,362C 'expect':158C 'fifo':12A,56B,184C,249C,271C 'file':172C 'flag':332C,346C 'follow':80C 'get':121C,261C 'go':140C 'handl':223C 'hang':7A,69B,285C 'hasn':207C 'interrupt':126C,377C,381C 'io':3A,20B,33B,85C,108C,113C,217C,221C,225C,233C,237C,245C,312C,360C 'io-wq':107C,359C 'ior':266C 'iosq':275C 'isn':375C 'kernel':2A,24B,31B,78C 'kill':74B,300C 'kvm':295C 'leav':65B 'left':146C 'like':365C 'linux':1A,23B,30B,77C 'linux-kernel':22B 'lose':89C,214C 'never':64B,260C 'notifi':231C,243C,303C,338C 'op':267C 'open':13A,53B,169C,181C,250C 'openat':268C 'partner':253C 'process':72B,298C 'provid':340C 'race':27B 'request':102C 'resolv':84C 'run':154C,238C,370C 'runtim':25B 'seen':352C 'sent':44B 'set':229C,301C,316C,320C 'signal':43B,91C,117C,194C,201C,216C,232C,244C,304C,325C,339C 'sleep':127C 'start':50B,209C,310C,356C 'stay':347C 'submit':247C,283C 'task':239C 'teardown':36B 'test':329C 'thread':9A,62B,97C,259C,280C 'tif':230C,242C,302C 'time':373C 'timeout':257C 'torn':111C 'track':101C 'treat':364C 'unbound':147C 'unless':378C 'ure':4A,21B,34B 'uring/io-wq':86C 'vulner':81C 'wait':129C,185C,251C,254C,380C 'wake':41B,228C 'wake-up':40B 'without':272C 'work':94C,143C,148C,152C,211C,224C,236C,240C,248C,307C,353C,366C 'worker':35B,47B,116C,119C,199C,205C,220C,222C,227C,323C 'wq':109C,114C,218C,226C,246C,313C,361C 'writer':59B,274C 'yet':173C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with io_uring enabled, where a process submits OPENAT operations (with IOSQE_ASYNC) against a FIFO that may have no writer. The sources do not name affected kernel version ranges. unknown whether default configurations are exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["iouring","linuxkernel","low","runtime"],"first_public_at":"2026-11-02T16:17:47+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99228","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99228","severity":null,"published_at":"2026-11-02T16:17:47+00:00","modified_at":"2026-11-02T16:17:47+00:00","first_seen_at":"2026-11-02T16:24:05+00:00","fetched_at":"2026-11-02T16:24:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}