Local Task Work Vulnerability in Linux Kernel Affecting io_uring Functionality

CVE-2026-99268

What is CVE-2026-99268?

A vulnerability exists in the Linux Kernel's io_uring mechanism that affects how local task work is managed and reported. When completions are queued as local work using the IORING_SETUP_DEFER_TASKRUN flag, they only transform into completion queue entries (CQEs) when the application submits requests into the kernel and waits for events. This presents an issue for applications leveraging poll() or epoll on the ring file descriptor, as the io_uring_poll() function will only signal that there are pending local work tasks when the work was there at the time of the call. If the application has already entered a sleep state, the local work may go unreported, leading to delays and inefficiencies. Recent updates addressed this flaw by implementing robust wake-up mechanisms that ensure the waiting submitter is properly notified when tasks are ready for execution, thus enhancing the reliability of the io_uring polling process.

References