{"id":"CVE-2026-99243","kind":"vulnerability","aliases":["CVE-2026-99243"],"related":[],"title":"Linux kernel: io_uring worker exit can hang on weakly ordered CPUs","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio-wq: order the exit bit against worker creation task work\n\nio_wq_exit_workers() cancels task work for queued worker creation with\ntask_work_cancel_match(). That has a plain load of task->task_works.\n\nio_queue_worker_create() adds the new entry and tests IO_WQ_BIT_EXIT to\ncancel it if the workqueue is already on its way out.\n\nThat must be ordered. task_work_add() has a full barrier via cmpxchg().\nBut io_wq_exit_start() sets the bit with set_bit() which doesn't have\nany memory ordering.\n\nSo afaict, on weakly ordered architectures the exiting task may load\ntask_works before the store of the bit is visible. The other side tests\nthe bit before the store is visible as well. So the entry remains queued\nwith worker_refs and the exiting task waits on worker_done indefinitely.\n\nIf the task still has rings then io_uring_del_tctx_node() provides the\nbarrier via test_and_set_bit() in io_wq_set_exit_on_idle(). When it\nhas closed all rings though that barrier is gone.\n\nAdd the barrier after the set_bit().","summary":"A memory-ordering bug in the Linux kernel's io_uring worker cleanup can leave an exiting task waiting forever on a worker that never finishes. The sources describe a hang (denial of service), not code execution or data theft.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["io_uring","linux-kernel","other","self-hosted"],"not_affected_if":["kernel-without-io_uring"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-03T12:17:30+00:00","first_seen_at":"2026-11-03T12:20:38+00:00","triaged_at":"2026-11-03T12:23:04+00:00","updated_at":"2026-11-03T12:23:04+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-03T12:23:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: io_uring worker exit can hang on weakly ordered CPUs","impact":"low","summary":"A memory-ordering bug in the Linux kernel's io_uring worker cleanup can leave an exiting task waiting forever on a worker that never finishes. The sources describe a hang (denial of service), not code execution or data theft.","audience":"businesses","category":"other","nicknames":[],"who_cares":["linux-kernel","io_uring","self-hosted"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"a process hangs indefinitely during io_uring teardown","analyst_note":"Check the upstream kernel commit and stable backports for the affected and fixed kernel versions, and confirm whether an unprivileged local user can trigger the hang.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["kernel-without-io_uring"],"who_is_affected":"Systems running a Linux kernel with io_uring, especially on weakly ordered architectures such as ARM, where a process tearing down io_uring rings can hang. The sources do not say which kernel versions are affected or what triggers the race from user space.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000676,"input_tokens":4405,"output_tokens":471,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-99243':15A,18A 'add':120C,148C,262C 'afaict':174C 'alreadi':137C 'architectur':178C 'barrier':152C,238C,259C,264C 'bit':85C,128C,162C,165C,191C,199C,243C,268C 'bug':32B 'cancel':95C,105C,131C 'cleanup':41B 'close':254C 'cmpxchg':154C 'code':64B 'cpus':12A 'creat':119C 'creation':88C,101C 'cve':13A,16A 'data':67B 'del':233C 'denial':60B 'describ':57B 'doesn':167C 'done':222C 'entri':123C,209C 'execut':65B 'exit':6A,45B,84C,93C,129C,158C,180C,217C,248C 'finish':54B 'follow':74C 'forev':48B 'full':151C 'gone':261C 'hang':8A,59B 'host':27B 'idl':250C 'indefinit':223C 'io':3A,19B,38B,80C,91C,116C,126C,156C,231C,245C 'io-wq':79C 'kernel':2A,23B,36B,72C 'leav':43B 'linux':1A,22B,35B,71C 'linux-kernel':21B 'load':111C,183C 'match':106C 'may':182C 'memori':30B,171C 'memory-ord':29B 'must':143C 'never':53B 'new':122C 'node':235C 'order':11A,31B,82C,145C,172C,177C 'plain':110C 'provid':236C 'queu':99C,211C 'queue':117C 'ref':214C 'remain':210C 'resolv':78C 'ring':229C,256C 'self':26B 'self-host':25B 'servic':62B 'set':160C,164C,242C,247C,267C 'side':196C 'sourc':56B 'start':159C 'still':227C 'store':188C,202C 'task':46B,89C,96C,103C,113C,114C,146C,181C,184C,218C,226C 'tctx':234C 'test':125C,197C,240C 'theft':68B 'though':257C 'ure':4A,20B,39B,232C 'via':153C,239C 'visibl':193C,204C 'vulner':75C 'wait':47B,219C 'way':140C 'weak':10A,176C 'well':206C 'work':90C,97C,104C,115C,147C,185C 'worker':5A,40B,51B,87C,94C,100C,118C,213C,221C 'workqueu':135C 'wq':81C,92C,127C,157C,246C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with io_uring, especially on weakly ordered architectures such as ARM, where a process tearing down io_uring rings can hang. The sources do not say which kernel versions are affected or what triggers the race from user space.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["iouring","linuxkernel","other","selfhosted","unknown"],"first_public_at":"2026-11-03T12:17:30+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99243","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99243","severity":null,"published_at":"2026-11-03T12:17:30+00:00","modified_at":"2026-11-03T12:17:30+00:00","first_seen_at":"2026-11-03T12:20:38+00:00","fetched_at":"2026-11-03T12:20:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}