Linux Kernel io_uring/mpscq Vulnerability in Multiple Products

CVE-2026-99252

What is CVE-2026-99252?

The Linux kernel has a vulnerability involving improper handling of push operations in the io_uring mult-producer single-consumer queue (mpscq). This flaw can be exploited when the push operation does not adequately prevent preemption, resulting in race conditions that can lead to a consumer spinning indefinitely while waiting for events. Specifically, this is triggered when a consumer with higher priority preempts a lower-priority producer within the same CPU environment. This issue can cause disruptions in task management and hinder system performance until resolved.

References