CVE-2026-64425

io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item

Published Jul 25, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item

commit 10dc95939817 ("io_uring/io-wq: check IO_WQ_BIT_EXIT inside work
run loop") fixed the obvious case where io_worker_handle_work() took one
exit-bit snapshot before draining pending work, but the fix stops one
level too early.

io_worker_handle_work() now re-checks IO_WQ_BIT_EXIT in its outer work
run loop, yet it still snapshots that bit once before processing a whole
dependent linked-work chain. If io_wq_exit_start() sets IO_WQ_BIT_EXIT
after the first linked item has started, the remaining linked items can
still reuse stale do_kill = false, skip IO_WQ_WORK_CANCEL, and continue
running after exit has begun.

Move the check further inside, so it covers linked items too. Note: this
is a syzbot special as it loves setting up tons of slow linked work on
weird devices like msr that take forever to read, and immediately close
the ring. Exit then takes a long time.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`065dd936195a3466b8ebe5f9287400987ee3c063`	affected	< 14b7ecad2ec56699325180a744f4b19f046401bb
`27e47500fac23d15b7dc93ff650bc4844d2581bd`	affected	< d179533c610e1b4c6aa436e3c1fd1b719d2c727c
`d05d99573f81a091547b1778b9a50120f5d6c68a`	affected	< 6e2f51f3e06773c2ee98ad09738f0908b48f76f9
`85eb83694a91c89d9abe615d717c0053c3efa714`	affected	< ea61b04e1d7242cb37f5ed2cc91cf21a493f6597
`2e8ca1078b14142db2ce51cbd18ff9971560046b`	affected	< b6f179a653a934736c88d820fe0098c3c2532549
`bdf0bf73006ea8af9327cdb85cfdff4c23a5f966`	affected	< 1636d85dc139b07c0449308f2bb5e0c7a2e0da99
`10dc959398175736e495f71c771f8641e1ca1907`	affected	< ab85765cbe3258b43dc6729af0e6ce3a87a133d8
`10dc959398175736e495f71c771f8641e1ca1907`	affected	< 29bef9934b2521f787bb15dd1985d4c0d12ae02a
`5.10.253`	affected	< 5.10.261
`5.15.203`	affected	< 5.15.212
`6.1.167`	affected	< 6.1.178
`6.6.122`	affected	< 6.6.145
`6.12.68`	affected	< 6.12.96
`6.18.8`	affected	< 6.18.39

Linux

affected

Version	Status	Constraints
`6.19`	affected	—
`0`	unaffected	< 6.19
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:6.19:-::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc7::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc8::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[065dd936195a3466b8ebe5f9287400987ee3c063,14b7ecad2ec56699325180a744f4b19f046401bb)`	affected	code_commit	—
`[27e47500fac23d15b7dc93ff650bc4844d2581bd,d179533c610e1b4c6aa436e3c1fd1b719d2c727c)`	affected	code_commit	—
`[d05d99573f81a091547b1778b9a50120f5d6c68a,6e2f51f3e06773c2ee98ad09738f0908b48f76f9)`	affected	code_commit	—
`[85eb83694a91c89d9abe615d717c0053c3efa714,ea61b04e1d7242cb37f5ed2cc91cf21a493f6597)`	affected	code_commit	—
`[2e8ca1078b14142db2ce51cbd18ff9971560046b,b6f179a653a934736c88d820fe0098c3c2532549)`	affected	code_commit	—
`[bdf0bf73006ea8af9327cdb85cfdff4c23a5f966,1636d85dc139b07c0449308f2bb5e0c7a2e0da99)`	affected	code_commit	—
`[10dc959398175736e495f71c771f8641e1ca1907,ab85765cbe3258b43dc6729af0e6ce3a87a133d8)`	affected	code_commit	—
`[10dc959398175736e495f71c771f8641e1ca1907,29bef9934b2521f787bb15dd1985d4c0d12ae02a)`	affected	code_commit	—
`[5.10.253,5.10.261)`	affected	semver	—
`[5.15.203,5.15.212)`	affected	semver	—
`[6.1.167,6.1.178)`	affected	semver	—
`[6.6.122,6.6.145)`	affected	semver	—
`[6.12.68,6.12.96)`	affected	semver	—
`[6.18.8,6.18.39)`	affected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.19`	affected	generic	—
`[0,6.19)`	unaffected	generic	—
`[5.10.261,5.11.0)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.96,6.13.0)`	unaffected	semver	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.4,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4717-1	linux security update
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package
Ubuntu USN	USN-8726-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8727-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8760-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8726-2	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8726-3	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8800-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8760-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8726-4	Linux kernel vulnerabilities
Ubuntu USN	USN-8728-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8728-3	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8876-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8875-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8877-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8878-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8879-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8875-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8917-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8918-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.129% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html
https://git.kernel.org/stable/c/14b7ecad2ec56699325180a744f4b19f046401bb
https://git.kernel.org/stable/c/1636d85dc139b07c0449308f2bb5e0c7a2e0da99
https://git.kernel.org/stable/c/29bef9934b2521f787bb15dd1985d4c0d12ae02a
https://git.kernel.org/stable/c/6e2f51f3e06773c2ee98ad09738f0908b48f76f9
https://git.kernel.org/stable/c/ab85765cbe3258b43dc6729af0e6ce3a87a133d8
https://git.kernel.org/stable/c/b6f179a653a934736c88d820fe0098c3c2532549
https://git.kernel.org/stable/c/d179533c610e1b4c6aa436e3c1fd1b719d2c727c
https://git.kernel.org/stable/c/ea61b04e1d7242cb37f5ed2cc91cf21a493f6597
https://lore.kernel.org/linux-cve-announce/2026072535-CVE-2026-64425-5940@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64425
https://www.cve.org/CVERecord?id=CVE-2026-64425

History

Nov 7, 2026 7:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 15, 2026 2:30 AM Added references View changes

Type	Values Removed	Values Added
References		https://cert-portal.siemens.com/productcert/html/ssa-457936.html

Sep 8, 2026 9:30 AM Added references View changes

Type	Values Removed	Values Added
References		https://cert-portal.siemens.com/productcert/html/ssa-019113.html

Sep 4, 2026 3:45 PM Weaknesses updated. Affected versions updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:o:linux:linux_kernel:6.19:-:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc7:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc8::::::
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Aug 5, 2026 12:45 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-362

Jul 30, 2026 12:15 AM Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Weaknesses		CWE-1050
References		https://lore.kernel.org/linux-cve-announce/2026072535-CVE-2026-64425-5940@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64425 https://www.cve.org/CVERecord?id=CVE-2026-64425

Jul 28, 2026 4:15 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-362

Jul 25, 2026 9:30 AM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item commit 10dc95939817 ("io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop") fixed the obvious case where io_worker_handle_work() took one exit-bit snapshot before draining pending work, but the fix stops one level too early. io_worker_handle_work() now re-checks IO_WQ_BIT_EXIT in its outer work run loop, yet it still snapshots that bit once before processing a whole dependent linked-work chain. If io_wq_exit_start() sets IO_WQ_BIT_EXIT after the first linked item has started, the remaining linked items can still reuse stale do_kill = false, skip IO_WQ_WORK_CANCEL, and continue running after exit has begun. Move the check further inside, so it covers linked items too. Note: this is a syzbot special as it loves setting up tons of slow linked work on weird devices like msr that take forever to read, and immediately close the ring. Exit then takes a long time.
Title		io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/14b7ecad2ec56699325180a744f4b19f046401bb https://git.kernel.org/stable/c/1636d85dc139b07c0449308f2bb5e0c7a2e0da99 https://git.kernel.org/stable/c/29bef9934b2521f787bb15dd1985d4c0d12ae02a https://git.kernel.org/stable/c/6e2f51f3e06773c2ee98ad09738f0908b48f76f9 https://git.kernel.org/stable/c/ab85765cbe3258b43dc6729af0e6ce3a87a133d8 https://git.kernel.org/stable/c/b6f179a653a934736c88d820fe0098c3c2532549 https://git.kernel.org/stable/c/d179533c610e1b4c6aa436e3c1fd1b719d2c727c https://git.kernel.org/stable/c/ea61b04e1d7242cb37f5ed2cc91cf21a493f6597