{"id":"CVE-2026-99252","kind":"vulnerability","aliases":["CVE-2026-99252"],"related":[],"title":"Linux kernel: io_uring queue push race can stall a high-priority consumer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/mpscq: disable preemption while pushing\n\nA push makes the node the new tail, and then links it to its predecessor.\nIn between the queue isn't empty, but mpscq_pop() can't get at the node.\nThe consumers deal with that by trying again, with a cond_resched() in\nthe loop to give a preempted producer the chance to finish.\n\ncond_resched() doesn't do that if the consumer has a higher priority than\nthe producer and both have to use the same CPU:\n\n  producer (SCHED_OTHER)              consumer (SCHED_FIFO), same CPU\n  io_req_local_work_add()\n    mpscq_push()\n      prev = xchg(&q->tail, node)\n  <preempted>                         io_cqring_wait()\n                                        __io_run_local_work()\n                                      again:\n                                          cond_resched()  // nothing to do\n                                          mpscq_pop()     // NULL\n                                          // work pending, no events yet\n                                          goto again\n\nThe producer can be any task that is able to queue task_work for the\nring: an io-wq worker, or somebody who sends a message with\nIORING_OP_MSG_RING. The consumer spins, holding ->uring_lock, until the\nscheduler takes pity on the fair class, which takes about a second with\nthe default settings of the fair server, and forever without it. The\nloops in tctx_task_work_run() and io_cancel_local_task_work() have the\nsame problem.\n\nDon't allow preemption between the two steps. That bounds the time the\nwindow is open on the CPU of the producer by what interrupts take, and a\nconsumer that waits for that is on another CPU. The cost is a\npreempt_disable()/preempt_enable() pair per push.","summary":"A race in the Linux kernel's io_uring lockless queue lets a higher-priority task on the same CPU spin forever while a preempted producer has not finished linking a node. The sources describe a hang or denial of service, not code execution or data theft.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["io_uring","kernel","linux","runtime"],"not_affected_if":["io_uring-disabled","no-realtime-priority-tasks"],"how_to_check":"- Check the running kernel version with `uname -r` and compare it against the fixed kernel releases in the sources.\n- Check whether the system uses io_uring at all, for example whether `io_uring_disabled` is set in `/proc/sys/kernel/io_uring_disabled`.","fix":null,"status":"open","published_at":"2026-11-03T12:17:31+00:00","first_seen_at":"2026-11-03T12:20:39+00:00","triaged_at":"2026-11-03T12:22:55+00:00","updated_at":"2026-11-03T12:22:55+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-03T12:22:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: io_uring queue push race can stall a high-priority consumer","impact":"low","summary":"A race in the Linux kernel's io_uring lockless queue lets a higher-priority task on the same CPU spin forever while a preempted producer has not finished linking a node. The sources describe a hang or denial of service, not code execution or data theft.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux","io_uring","kernel"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"a local task stalls the CPU and blocks io_uring completions","analyst_note":"Find the fixed kernel versions and the affected version ranges from the kernel stable commit or NVD entry for CVE-2026-99252.","how_to_check":"- Check the running kernel version with `uname -r` and compare it against the fixed kernel releases in the sources.\n- Check whether the system uses io_uring at all, for example whether `io_uring_disabled` is set in `/proc/sys/kernel/io_uring_disabled`.","plain_action":"","needs_analyst":true,"not_affected_if":["io_uring-disabled","no-realtime-priority-tasks"],"who_is_affected":"Systems running a Linux kernel with io_uring where a SCHED_FIFO task and a SCHED_OTHER producer share a CPU, such as code that waits on io_uring completions with real-time priorities. The sources do not give the affected version ranges. Systems that do not use io_uring are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00075,"input_tokens":4596,"output_tokens":581,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-99252':17A,20A '/preempt_enable':336C 'abl':220C 'add':181C 'allow':295C 'anoth':328C 'bound':302C 'cancel':285C 'chanc':142C 'class':258C 'code':69B 'cond':131C,145C,197C 'consum':14A,122C,153C,172C,245C,321C 'cost':331C 'cpu':46B,168C,176C,311C,329C 'cqring':190C 'cve':15A,18A 'data':72B 'deal':123C 'default':266C 'denial':65B 'describ':61B 'disabl':86C,335C 'doesn':147C 'empti':111C 'event':208C 'execut':70B 'fair':257C,270C 'fifo':174C 'finish':55B,144C 'follow':79C 'forev':48B,273C 'get':117C 'give':137C 'goto':210C 'hang':63B 'high':12A 'high-prior':11A 'higher':40B,156C 'higher-prior':39B 'hold':247C 'interrupt':317C 'io':3A,21B,33B,84C,177C,189C,192C,230C,284C 'io-wq':229C 'ior':240C 'isn':109C 'kernel':2A,23B,31B,77C 'let':37B 'link':56B,100C 'linux':1A,24B,30B,76C 'local':179C,194C,286C 'lock':249C 'lockless':35B 'loop':135C,277C 'make':92C 'messag':238C 'mpscq':113C,182C,202C 'msg':242C 'new':96C 'node':58B,94C,120C,188C 'noth':199C 'null':204C 'op':241C 'open':308C 'pair':337C 'pend':206C 'per':338C 'piti':254C 'pop':114C,203C 'predecessor':104C 'preempt':51B,139C,334C 'preemption':87C,296C 'prev':184C 'prioriti':13A,41B,157C 'problem':292C 'produc':52B,140C,160C,169C,213C,314C 'push':6A,89C,91C,183C,339C 'q':186C 'queue':5A,36B,108C,222C 'race':7A,27B 'req':178C 'resch':132C,146C,198C 'resolv':83C 'ring':227C,243C 'run':193C,282C 'runtim':25B 'sched':170C,173C 'schedul':252C 'second':263C 'send':236C 'server':271C 'servic':67B 'set':267C 'somebodi':234C 'sourc':60B 'spin':47B,246C 'stall':9A 'step':300C 'tail':97C,187C 'take':253C,260C,318C 'task':42B,217C,223C,280C,287C 'tctx':279C 'theft':73B 'time':304C 'tri':127C 'two':299C 'ure':4A,22B,34B,248C 'uring/mpscq':85C 'use':165C 'vulner':80C 'wait':191C,323C 'window':306C 'without':274C 'work':180C,195C,205C,224C,281C,288C 'worker':232C 'wq':231C 'xchg':185C 'yet':209C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with io_uring where a SCHED_FIFO task and a SCHED_OTHER producer share a CPU, such as code that waits on io_uring completions with real-time priorities. The sources do not give the affected version ranges. Systems that do not use io_uring are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["iouring","kernel","linux","runtime","unknown"],"first_public_at":"2026-11-03T12:17:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99252","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99252","severity":null,"published_at":"2026-11-03T12:17:31+00:00","modified_at":"2026-11-03T12:17:31+00:00","first_seen_at":"2026-11-03T12:20:39+00:00","fetched_at":"2026-11-03T12:20:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}