---
id: "CVE-2026-99254"
kind: "vulnerability"
aliases: ["CVE-2026-99254"]
title: "Linux kernel io_uring: exiting task flooded with task_work, stalling CPUs"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["io_uring", "kernel", "kubernetes", "linux", "runtime", "self-hosted"]
not_affected_if: ["no-io_uring-use"]
published_at: "2026-11-03T12:17:32+00:00"
first_seen_at: "2026-11-03T12:20:39+00:00"
updated_at: "2026-11-03T12:22:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99254", "first_seen_at": "2026-11-03T12:20:39+00:00"}]
---

# Linux kernel io_uring: exiting task flooded with task_work, stalling CPUs

In the Linux kernel's io_uring subsystem, the ring-exit work item keeps re-queuing cleanup callbacks to a task already in cancellation, so that task never returns from cancellation. The effect is a task that cannot be killed and keeps a CPU busy for seconds to minutes, with no privilege needed to trigger it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the running kernel version with `uname -r` and compare it against the fixed kernel releases in the NVD entry for CVE-2026-99254.
- Look for io_uring use in your workloads: `grep -r io_uring /proc/*/maps` or check whether services use liburing.

## Fix

- Linux kernel: the fixed version is unknown; the sources do not list specific kernel ranges.

## Timeline

- 2026-11-03T12:20:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99254

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

io_uring: don't flood a cancelling task with task_work

io_ring_exit_work() asks each task which has used the ring to remove its
tctx node, by task_work, and repeats that until the list is empty.
io_tctx_exit_cb() doesn't touch the node while the task is in
io_uring_cancel_generic(), which removes all the nodes at its end. So the
work item queues the callback again as soon as it has completed, for
nothing.

That is more than a waste of time. task_work_run() only returns when it
finds the list empty. If the rings are released from inside the
cancellation, because requests of other rings held the last references to
their files, up to 64 work items keep sending callbacks to the one task
which is running them. It never finds the list empty, never gets back to
the cancellation, the nodes stay, and so it goes on: a task with 60 pairs
of rings which poll each other ran 280000 callbacks in 5 seconds, 20
seconds after exit_group(). It ends when all the senders happen to be late
at the same time. Until then the task keeps a CPU and the work items busy.

An exiting task can't be killed meanwhile. execve() cancels the requests in
the same way, so a live task can get stuck there as well, for minutes. If
it takes more than five, the work items run into the
WARN_ON_ONCE(time_after(jiffies, timeout)) of io_ring_exit_work(). No
privilege is needed for any of this.

If the callback has met a task in cancellation, wait a little before it is
sent again. Nobody has to wake the work item up for that: either the node
is gone by then, or it is the turn of the next round.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_