I/O Request Handling Issue in Linux Kernel Affecting Task Cancellation

CVE-2026-99255

What is CVE-2026-99255?

A vulnerability exists within the Linux kernel's I/O request handling, specifically related to the cancellation of tasks using the io_uring and io-wq subsystems. When a task exits, it cancels its tracked requests and enters a state of waiting for the requests to be processed. However, a timing issue may arise whereby a request, linked to a task exiting, cannot be identified during cancellation checks, potentially leading to a deadlock state. Subsequent worker processes may continue to run requests that should have been cancelled, leaving the original task unable to terminate correctly. This vulnerability is exacerbated in high-load scenarios, where multiple tasks may experience delays in processing due to this flaw in handling I/O links.

References