In the Linux kernel, the following vulnerability has been resolved:
io_uring: ensure ctx->rings is stable for task work flags manipulation
If DEFER_TASKRUN | SETUP_TASKRUN is used and task work is added while the ring is being resized, it's possible for the OR'ing of IORING_SQ_TASKRUN to happen in the small window of swapping into the new rings and the old rings being freed.
Prevent this by adding a 2nd ->rings pointer, ->rings_rcu, which is protected by RCU. The task work flags manipulation is inside RCU already, and if the resize ring freeing is done post an RCU synchronize, then there's no need to add locking to the fast path of task work additions.
Note: this is only done for DEFER_TASKRUN, as that's the only setup mode that supports ring resizing. If this ever changes, then they too need to use the io_ctx_mark_taskrun() helper.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel6.18-debuginfo-common-aarch64Upgrade bpftool6.18-debuginfoUpgrade kernel6.18-debuginfoUpgrade kernel6.18-debuginfo-common-x86_64Upgrade bpftool6.18Upgrade kernel6.18-develUpgrade kernel6.18-modules-extra-commonUpgrade kernel6.18-tools-develUpgrade perf6.18Upgrade kernel6.18-toolsUpgrade kernel6.18-tools-debuginfoUpgrade kernel6.18-libbpf-develUpgrade kernel6.18-libbpf-staticUpgrade kernel6.18-modules-extraUpgrade kernel6.18-libbpf-debuginfoUpgrade kernel6.18-headersUpgrade kernel6.18-libbpfUpgrade python3-perf6.18Upgrade python3-perf6.18-debuginfoUpgrade perf6.18-debuginfoUpgrade kernel6.18Upgrade kernel-livepatch-6.18.20-20.229 | May 4, 2026 | Mar 20, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Mar 20, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub