{"identifier":"CVE-2026-99228","cve":{"id":"CVE-2026-99228","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/io-wq: don't lose the signal that ends work\n\nWhen a thread exits, only its tracked requests are cancelled. Then its\nio-wq is torn down. io_wq_exit_workers() signals every worker, to get it\nout of an interruptible sleep, and waits for all of them to exit. Before\nthey do, they go through the work that is left. Unbounded work is\ncancelled. Bounded work is run, as it is expected to end by itself.\n\nNot all of it does. An open has no file yet, so it counts as bounded, and\nthe open of a FIFO waits for the other end. That is what the signal is for.\nBut the workers are signalled once, and a worker that hasn't started the\nwork by then loses the signal:\n\n  io_wq_exit_workers()               io_worker_handle_work()\n    io_wq_worker_wake()\n      set TIF_NOTIFY_SIGNAL\n                                       io_assign_current_work()\n                                         io_run_task_work()\n                                           clear TIF_NOTIFY_SIGNAL\n                                       io_wq_submit_work()\n                                         fifo_open()\n                                           wait_for_partner()\n    wait_for_completion_timeout()\n\nThe thread never gets out of do_exit():\n\n  IORING_OP_OPENAT of a FIFO without a writer, IOSQE_ASYNC\n  exit of the thread that has submitted it\n\nhangs in more than 9 of 10 attempts (4 CPUs, KVM), until the process is\nkilled.\n\nSet TIF_NOTIFY_SIGNAL for bounded work that is started with IO_WQ_BIT_EXIT\nset. The bit is set before the workers are signalled, and it is tested\nafter the flag has been cleared, with clear_notify_signal() providing the\nbarrier. So either the flag stays, or the bit is seen.\n\nWork that is started while the io-wq exits is treated like work that is\nbeing run at that time: it isn't interrupted unless it waits\ninterruptibly.","published":"2026-11-02T16:17:47.600000+00:00","modified":"2026-11-02T16:17:47.600000+00:00","status":"Received","score":null,"severity":"UNSCORED","vector":"","cvss_version":"","affected":[],"weaknesses":[],"references":[{"url":"https://git.kernel.org/stable/c/08c42055b8f9a5d29236d34ad4bce08828239fe1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/62996803c1b5f18176de255db4c843021f2d19c8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7309fea05a3d66af9746843c43fef14c10b8141e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ddccc60f036b309430cf130d48aafed94ef7355a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fdb771015c1e13677b57a4015f0c938748f13781","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"kev":null,"kev_checked":true,"metrics":{},"configurations":[],"source":"nvd","retrieved_at":"2026-11-02T19:29:44.614759+00:00","exploited":false,"kev_stale":false,"products":[],"priority":{"label":"Assess exposure and vendor guidance","reasons":["No higher-priority signal is available in the current stored evidence.","Fresh EPSS data is unavailable; missing values are not zero."]},"epss":null,"version_assessment":null},"news":[],"campaigns":[],"domains":[{"domain":"git.kernel.org","source_url":"https://git.kernel.org/stable/c/08c42055b8f9a5d29236d34ad4bce08828239fe1","investigate_url":"https://investigate.aeglixmind.com/#git.kernel.org"}],"arsenal_url":"https://arsenal.aeglixmind.com/?cve=CVE-2026-99228","catalog_url":"https://cves.aeglixmind.com/cve/CVE-2026-99228","research_url":"https://investigate.aeglixmind.com/research/cve/CVE-2026-99228","coverage":{"news_candidates_checked":0,"campaign_candidates_checked":0,"bounded":false,"notice":"Exact CVE mentions in stored public excerpts and reviewed campaign content only. A mention is not proof of exploitation, attribution or tool suitability. Missing matches do not establish absence."}}