{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"14b7ecad2ec56699325180a744f4b19f046401bb","status":"affected","version":"065dd936195a3466b8ebe5f9287400987ee3c063","versionType":"git"},{"lessThan":"d179533c610e1b4c6aa436e3c1fd1b719d2c727c","status":"affected","version":"27e47500fac23d15b7dc93ff650bc4844d2581bd","versionType":"git"},{"lessThan":"6e2f51f3e06773c2ee98ad09738f0908b48f76f9","status":"affected","version":"d05d99573f81a091547b1778b9a50120f5d6c68a","versionType":"git"},{"lessThan":"ea61b04e1d7242cb37f5ed2cc91cf21a493f6597","status":"affected","version":"85eb83694a91c89d9abe615d717c0053c3efa714","versionType":"git"},{"lessThan":"b6f179a653a934736c88d820fe0098c3c2532549","status":"affected","version":"2e8ca1078b14142db2ce51cbd18ff9971560046b","versionType":"git"},{"lessThan":"1636d85dc139b07c0449308f2bb5e0c7a2e0da99","status":"affected","version":"bdf0bf73006ea8af9327cdb85cfdff4c23a5f966","versionType":"git"},{"lessThan":"ab85765cbe3258b43dc6729af0e6ce3a87a133d8","status":"affected","version":"10dc959398175736e495f71c771f8641e1ca1907","versionType":"git"},{"lessThan":"29bef9934b2521f787bb15dd1985d4c0d12ae02a","status":"affected","version":"10dc959398175736e495f71c771f8641e1ca1907","versionType":"git"},{"lessThan":"5.10.261","status":"affected","version":"5.10.253","versionType":"semver"},{"lessThan":"5.15.212","status":"affected","version":"5.15.203","versionType":"semver"},{"lessThan":"6.1.178","status":"affected","version":"6.1.167","versionType":"semver"},{"lessThan":"6.6.145","status":"affected","version":"6.6.122","versionType":"semver"},{"lessThan":"6.12.96","status":"affected","version":"6.12.68","versionType":"semver"},{"lessThan":"6.18.39","status":"affected","version":"6.18.8","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"cpeConfigurations":[{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.261","versionStartIncluding":"5.10.253","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.212","versionStartIncluding":"5.15.203","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.178","versionStartIncluding":"6.1.167","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.145","versionStartIncluding":"6.6.122","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.96","versionStartIncluding":"6.12.68","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.39","versionStartIncluding":"6.18.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.4","versionStartIncluding":"6.19.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"cveId":"CVE-2026-64425","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item\n\ncommit 10dc95939817 (\"io_uring/io-wq: check IO_WQ_BIT_EXIT inside work\nrun loop\") fixed the obvious case where io_worker_handle_work() took one\nexit-bit snapshot before draining pending work, but the fix stops one\nlevel too early.\n\nio_worker_handle_work() now re-checks IO_WQ_BIT_EXIT in its outer work\nrun loop, yet it still snapshots that bit once before processing a whole\ndependent linked-work chain. If io_wq_exit_start() sets IO_WQ_BIT_EXIT\nafter the first linked item has started, the remaining linked items can\nstill reuse stale do_kill = false, skip IO_WQ_WORK_CANCEL, and continue\nrunning after exit has begun.\n\nMove the check further inside, so it covers linked items too. Note: this\nis a syzbot special as it loves setting up tons of slow linked work on\nweird devices like msr that take forever to read, and immediately close\nthe ring. Exit then takes a long time.","epss":{"date":"2026-11-09","percentile":0.02538,"score":0.00129},"exploits":[],"kev":null,"metrics":[{"score":5.5,"severity":"medium","source":"NVD: nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1794314963960,"publishedAt":1784969463036,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/14b7ecad2ec56699325180a744f4b19f046401bb"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/d179533c610e1b4c6aa436e3c1fd1b719d2c727c"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/6e2f51f3e06773c2ee98ad09738f0908b48f76f9"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/ea61b04e1d7242cb37f5ed2cc91cf21a493f6597"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/b6f179a653a934736c88d820fe0098c3c2532549"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/1636d85dc139b07c0449308f2bb5e0c7a2e0da99"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/ab85765cbe3258b43dc6729af0e6ce3a87a133d8"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/29bef9934b2521f787bb15dd1985d4c0d12ae02a"},{"source":"ADP: siemens-SADP","tags":[],"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"ADP: siemens-SADP","tags":[],"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/14b7ecad2ec56699325180a744f4b19f046401bb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1636d85dc139b07c0449308f2bb5e0c7a2e0da99"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/29bef9934b2521f787bb15dd1985d4c0d12ae02a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6e2f51f3e06773c2ee98ad09738f0908b48f76f9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ab85765cbe3258b43dc6729af0e6ce3a87a133d8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b6f179a653a934736c88d820fe0098c3c2532549"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d179533c610e1b4c6aa436e3c1fd1b719d2c727c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ea61b04e1d7242cb37f5ed2cc91cf21a493f6597"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":[],"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":[],"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"remediation":[{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/14b7ecad2ec56699325180a744f4b19f046401bb"},{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/1636d85dc139b07c0449308f2bb5e0c7a2e0da99"},{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/29bef9934b2521f787bb15dd1985d4c0d12ae02a"},{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/6e2f51f3e06773c2ee98ad09738f0908b48f76f9"},{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/ab85765cbe3258b43dc6729af0e6ce3a87a133d8"},{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/b6f179a653a934736c88d820fe0098c3c2532549"},{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/d179533c610e1b4c6aa436e3c1fd1b719d2c727c"},{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/ea61b04e1d7242cb37f5ed2cc91cf21a493f6597"}],"revision":"e96a32c21e3939d2c4b58ad0c8165132b5441a5e40375ef1714431f9e838597a","sources":[{"modifiedAt":1794314963960,"name":"CNA: Linux","retrievedAt":1794316738922,"url":"https://www.cve.org/CVERecord?id=CVE-2026-64425"},{"modifiedAt":1793985533840,"name":"NVD","retrievedAt":1793989585327,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64425"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794291519633,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-64425"}],"ssvc":{"assessedAt":1793983096014,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item","updatedAt":1794316738922}