{"id":"CVE-2026-99253","kind":"vulnerability","aliases":["CVE-2026-99253"],"related":[],"title":"Linux kernel: io_uring race can leave a task stuck during exec or exit","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/cancel: rearm local work wake up before sleep\n\nio_uring_try_cancel_requests() sets ->cq_wait_nr to 1 so that the next\nio_req_local_work_add() wakes the cancelling task. The add that takes the\ncount to zero is the only one that wakes, later ones see a count <= 0 and\nreturn. io_uring_cancel_generic() however only becomes\nTASK_INTERRUPTIBLE much later, so the one wake up can be spent on a\nrunning task. That is fine as long as the entry of that add is still\nqueued, as the io_local_work_pending() check then skips the sleep. It is\nnot if the add was delayed after queueing its entry:\n\nCPU0 (submitter in exec or exit)      CPU1 (io_req_local_work_add)\n                                      mpscq_push(req A)\nio_uring_try_cancel_requests()\n  io_run_local_work()  // runs req A\nio_uring_try_cancel_requests()\n  atomic_set(&ctx->cq_wait_nr, 1)\n                                      atomic_read(&ctx->cq_wait_nr) == 1\n                                      count taken, wake_up_state()\n                                        // task is running, no-op\nprepare_to_wait(TASK_INTERRUPTIBLE)\nio_local_work_pending() == false\nschedule()\n                                      mpscq_push(req B)\n                                      cq_wait_nr <= 0, return\n\nOnly the sleeping task can run req B, so it is stuck in execve() until a\nsignal happens to wake it. An exiting task doesn't even get that.\n\nArm the count again once the task state is set and before the work list\nis checked, for the rings whose local work this task is the one to run.","summary":"A race in the Linux kernel's io_uring cancellation path can cause a task to sleep while a queued io_uring request is never run. The task then stays blocked in execve() or exit until a signal wakes it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["io_uring","kernel","linux","runtime"],"not_affected_if":["io_uring-disabled"],"how_to_check":"- Check the kernel version with `uname -r` and compare it against the fixed versions in the kernel stable branches.\n- Check whether io_uring is in use on the host, for example with `cat /proc/sys/kernel/io_uring_disabled`.","fix":null,"status":"open","published_at":"2026-11-03T12:17:32+00:00","first_seen_at":"2026-11-03T12:20:39+00:00","triaged_at":"2026-11-03T12:22:54+00:00","updated_at":"2026-11-03T12:22:54+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-03T12:22:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: io_uring race can leave a task stuck during exec or exit","impact":"low","summary":"A race in the Linux kernel's io_uring cancellation path can cause a task to sleep while a queued io_uring request is never run. The task then stays blocked in execve() or exit until a signal wakes it.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux","kernel","io_uring"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"a task hangs in exec or exit until a signal arrives","analyst_note":"Check the kernel.org CVE record and stable-branch commits for the affected and fixed version ranges.","how_to_check":"- Check the kernel version with `uname -r` and compare it against the fixed versions in the kernel stable branches.\n- Check whether io_uring is in use on the host, for example with `cat /proc/sys/kernel/io_uring_disabled`.","plain_action":"","needs_analyst":true,"not_affected_if":["io_uring-disabled"],"who_is_affected":"Systems running a Linux kernel with io_uring enabled, where processes use io_uring and call exec or exit. The sources do not say which kernel versions are affected or whether the impact is more than a hang. Hosts with io_uring disabled or without io_uring workloads are likely unaffected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000724,"input_tokens":4602,"output_tokens":527,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-99253':17A,20A '0':127C,266C '1':94C,229C,236C 'add':103C,109C,163C,183C,201C 'arm':297C 'atom':223C,230C 'b':262C,275C 'becom':136C 'block':56B 'cancel':35B,87C,106C,132C,209C,221C 'caus':38B 'check':173C,313C 'count':113C,126C,237C,299C 'cpu0':190C 'cpu1':196C 'cq':90C,226C,233C,263C 'ctx':225C,232C 'cve':15A,18A 'delay':185C 'doesn':292C 'entri':160C,189C 'even':294C 'exec':12A,193C 'execv':58B,281C 'exit':14A,60B,195C,290C 'fals':257C 'fine':155C 'follow':70C 'generic':133C 'get':295C 'happen':285C 'howev':134C 'interrupt':138C,252C 'io':3A,21B,33B,46B,75C,84C,99C,130C,169C,197C,206C,211C,218C,253C 'kernel':2A,23B,31B,68C 'later':122C,140C 'leav':7A 'linux':1A,24B,30B,67C 'list':311C 'local':78C,101C,170C,199C,213C,254C,318C 'long':157C 'mpscq':202C,259C 'much':139C 'never':50B 'next':98C 'no-op':245C 'nr':92C,228C,235C,265C 'one':119C,123C,143C,324C 'op':247C 'path':36B 'pend':172C,256C 'prepar':248C 'push':203C,260C 'queu':45B,166C 'queue':187C 'race':5A,27B 'read':231C 'rearm':77C 'req':100C,198C,204C,216C,261C,274C 'request':48B,88C,210C,222C 'resolv':74C 'return':129C,267C 'ring':316C 'run':51B,151C,212C,215C,244C,273C,326C 'runtim':25B 'schedul':258C 'see':124C 'set':89C,224C,306C 'signal':63B,284C 'skip':175C 'sleep':42B,83C,177C,270C 'spent':148C 'state':241C,304C 'stay':55B 'still':165C 'stuck':10A,279C 'submitt':191C 'take':111C 'taken':238C 'task':9A,40B,53B,107C,137C,152C,242C,251C,271C,291C,303C,321C 'tri':86C,208C,220C 'ure':4A,22B,34B,47B,85C,131C,207C,219C 'uring/cancel':76C 'vulner':71C 'wait':91C,227C,234C,250C,264C 'wake':64B,80C,104C,121C,144C,239C,287C 'whose':317C 'work':79C,102C,171C,200C,214C,255C,310C,319C 'zero':115C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with io_uring enabled, where processes use io_uring and call exec or exit. The sources do not say which kernel versions are affected or whether the impact is more than a hang. Hosts with io_uring disabled or without io_uring workloads are likely unaffected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["iouring","kernel","linux","runtime","unknown"],"first_public_at":"2026-11-03T12:17:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99253","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99253","severity":null,"published_at":"2026-11-03T12:17:32+00:00","modified_at":"2026-11-03T12:17:32+00:00","first_seen_at":"2026-11-03T12:20:39+00:00","fetched_at":"2026-11-03T12:20:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}