Kernel vulnerability in io_uring affecting Linux systems

CVE-2026-99228

What is CVE-2026-99228?

A vulnerability exists in the Linux kernel's io_uring which can lead to system hangs when threads exit while certain I/O operations are in progress. Specifically, if a thread signal is sent to workers before they are fully prepared to handle the workload, the system can hang indefinitely awaiting a response. This situation may occur particularly during FIFO operations where a critical signal is lost due to the timing of the worker process state transitions. Proper handling of bounded and unbounded work during thread exit sequences is crucial to prevent system deadlocks and ensure robust task management.

References