{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"aaa06bb9fc03384f7cf2dbc3e43f2939cc7791b2","status":"affected","version":"d46ab2c98ababa19b41a5709b6921d7b1add7f74","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"7.2"},{"lessThan":"7.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.14","versionType":"semver"}]}],"cveId":"CVE-2026-99253","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/cancel: rearm local work wake up before sleep\n\nio_uring_try_cancel_requests() sets ->cq_wait_nr to 1 so that the next\nio_req_local_work_add() wakes the cancelling task. The add that takes the\ncount to zero is the only one that wakes, later ones see a count <= 0 and\nreturn. io_uring_cancel_generic() however only becomes\nTASK_INTERRUPTIBLE much later, so the one wake up can be spent on a\nrunning task. That is fine as long as the entry of that add is still\nqueued, as the io_local_work_pending() check then skips the sleep. It is\nnot if the add was delayed after queueing its entry:\n\nCPU0 (submitter in exec or exit)      CPU1 (io_req_local_work_add)\n                                      mpscq_push(req A)\nio_uring_try_cancel_requests()\n  io_run_local_work()  // runs req A\nio_uring_try_cancel_requests()\n  atomic_set(&ctx->cq_wait_nr, 1)\n                                      atomic_read(&ctx->cq_wait_nr) == 1\n                                      count taken, wake_up_state()\n                                        // task is running, no-op\nprepare_to_wait(TASK_INTERRUPTIBLE)\nio_local_work_pending() == false\nschedule()\n                                      mpscq_push(req B)\n                                      cq_wait_nr <= 0, return\n\nOnly the sleeping task can run req B, so it is stuck in execve() until a\nsignal happens to wake it. An exiting task doesn't even get that.\n\nArm the count again once the task state is set and before the work list\nis checked, for the rings whose local work this task is the one to run.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793704812490,"publishedAt":1793704812490,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/aaa06bb9fc03384f7cf2dbc3e43f2939cc7791b2"}],"remediation":[],"revision":"f633fdf81c0673ce4c1b69fd46d963a112c7c1bd36131d49b557591f742692a5","sources":[{"modifiedAt":1793704812490,"name":"CNA: Linux","retrievedAt":1793707740569,"url":"https://www.cve.org/CVERecord?id=CVE-2026-99253"}],"ssvc":null,"status":"published","title":"io_uring/cancel: rearm local work wake up before sleep","updatedAt":1793707740569}