CVE-2026-99253

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99253", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.403Z", "datePublished": "2026-11-03T11:20:12.490Z", "dateUpdated": "2026-11-06T17:15:12.869Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-06T17:15:12.869Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/cancel: rearm local work wake up before sleep\n\nio_uring_try_cancel_requests() sets ->cq_wait_nr to 1 so that the next\nio_req_local_work_add() wakes the cancelling task. The add that takes the\ncount to zero is the only one that wakes, later ones see a count <= 0 and\nreturn. io_uring_cancel_generic() however only becomes\nTASK_INTERRUPTIBLE much later, so the one wake up can be spent on a\nrunning task. That is fine as long as the entry of that add is still\nqueued, as the io_local_work_pending() check then skips the sleep. It is\nnot if the add was delayed after queueing its entry:\n\nCPU0 (submitter in exec or exit) CPU1 (io_req_local_work_add)\n mpscq_push(req A)\nio_uring_try_cancel_requests()\n io_run_local_work() // runs req A\nio_uring_try_cancel_requests()\n atomic_set(&ctx->cq_wait_nr, 1)\n atomic_read(&ctx->cq_wait_nr) == 1\n count taken, wake_up_state()\n // task is running, no-op\nprepare_to_wait(TASK_INTERRUPTIBLE)\nio_local_work_pending() == false\nschedule()\n mpscq_push(req B)\n cq_wait_nr <= 0, return\n\nOnly the sleeping task can run req B, so it is stuck in execve() until a\nsignal happens to wake it. An exiting task doesn't even get that.\n\nArm the count again once the task state is set and before the work list\nis checked, for the rings whose local work this task is the one to run."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["io_uring/cancel.c"], "versions": [{"version": "d46ab2c98ababa19b41a5709b6921d7b1add7f74", "lessThan": "aaa06bb9fc03384f7cf2dbc3e43f2939cc7791b2", "status": "affected", "versionType": "git"}, {"version": "d46ab2c98ababa19b41a5709b6921d7b1add7f74", "lessThan": "58ddf0ec707093206a5fe814581ec5aefac8b08a", "status": "affected", "versionType": "git"}, {"version": "d46ab2c98ababa19b41a5709b6921d7b1add7f74", "lessThan": "76a82c666abf155ad52d5f41043eac77dd3e41d8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["io_uring/cancel.c"], "versions": [{"version": "7.2", "status": "affected"}, {"version": "0", "lessThan": "7.2", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.14", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3.2", "lessThanOrEqual": "7.3.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.4-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.2", "versionEndExcluding": "7.2.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.2", "versionEndExcluding": "7.3.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.2", "versionEndExcluding": "7.4-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/aaa06bb9fc03384f7cf2dbc3e43f2939cc7791b2"}, {"url": "https://git.kernel.org/stable/c/58ddf0ec707093206a5fe814581ec5aefac8b08a"}, {"url": "https://git.kernel.org/stable/c/76a82c666abf155ad52d5f41043eac77dd3e41d8"}], "title": "io_uring/cancel: rearm local work wake up before sleep", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["io_uring/cancel.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "aaa06bb9fc03384f7cf2dbc3e43f2939cc7791b2", "status": "affected", "version": "d46ab2c98ababa19b41a5709b6921d7b1add7f74", "versionType": "git"}, {"lessThan": "58ddf0ec707093206a5fe814581ec5aefac8b08a", "status": "affected", "version": "d46ab2c98ababa19b41a5709b6921d7b1add7f74", "versionType": "git"}, {"lessThan": "76a82c666abf155ad52d5f41043eac77dd3e41d8", "status": "affected", "version": "d46ab2c98ababa19b41a5709b6921d7b1add7f74", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["io_uring/cancel.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.2"}, {"lessThan": "7.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.14", "versionType": "semver"}, {"lessThanOrEqual": "7.3.*", "status": "unaffected", "version": "7.3.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.4-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/cancel: rearm local work wake up before sleep\n\nio_uring_try_cancel_requests() sets ->cq_wait_nr to 1 so that the next\nio_req_local_work_add() wakes the cancelling task. The add that takes the\ncount to zero is the only one that wakes, later ones see a count <= 0 and\nreturn. io_uring_cancel_generic() however only becomes\nTASK_INTERRUPTIBLE much later, so the one wake up can be spent on a\nrunning task. That is fine as long as the entry of that add is still\nqueued, as the io_local_work_pending() check then skips the sleep. It is\nnot if the add was delayed after queueing its entry:\n\nCPU0 (submitter in exec or exit) CPU1 (io_req_local_work_add)\n mpscq_push(req A)\nio_uring_try_cancel_requests()\n io_run_local_work() // runs req A\nio_uring_try_cancel_requests()\n atomic_set(&ctx->cq_wait_nr, 1)\n atomic_read(&ctx->cq_wait_nr) == 1\n count taken, wake_up_state()\n // task is running, no-op\nprepare_to_wait(TASK_INTERRUPTIBLE)\nio_local_work_pending() == false\nschedule()\n mpscq_push(req B)\n cq_wait_nr <= 0, return\n\nOnly the sleeping task can run req B, so it is stuck in execve() until a\nsignal happens to wake it. An exiting task doesn't even get that.\n\nArm the count again once the task state is set and before the work list\nis checked, for the rings whose local work this task is the one to run."}], "id": "CVE-2026-99253", "lastModified": "2026-11-06T18:18:33.357", "metrics": {}, "published": "2026-11-03T12:17:32.013", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/58ddf0ec707093206a5fe814581ec5aefac8b08a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/76a82c666abf155ad52d5f41043eac77dd3e41d8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/aaa06bb9fc03384f7cf2dbc3e43f2939cc7791b2"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via race condition in io_uring cancellation", "id": "2565719", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565719"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-821", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nio_uring/cancel: rearm local work wake up before sleep\nio_uring_try_cancel_requests() sets ->cq_wait_nr to 1 so that the next\nio_req_local_work_add() wakes the cancelling task. The add that takes the\ncount to zero is the only one that wakes, later ones see a count <= 0 and\nreturn. io_uring_cancel_generic() however only becomes\nTASK_INTERRUPTIBLE much later, so the one wake up can be spent on a\nrunning task. That is fine as long as the entry of that add is still\nqueued, as the io_local_work_pending() check then skips the sleep. It is\nnot if the add was delayed after queueing its entry:\nCPU0 (submitter in exec or exit) CPU1 (io_req_local_work_add)\nmpscq_push(req A)\nio_uring_try_cancel_requests()\nio_run_local_work() // runs req A\nio_uring_try_cancel_requests()\natomic_set(&ctx->cq_wait_nr, 1)\natomic_read(&ctx->cq_wait_nr) == 1\ncount taken, wake_up_state()\n// task is running, no-op\nprepare_to_wait(TASK_INTERRUPTIBLE)\nio_local_work_pending() == false\nschedule()\nmpscq_push(req B)\ncq_wait_nr <= 0, return\nOnly the sleeping task can run req B, so it is stuck in execve() until a\nsignal happens to wake it. An exiting task doesn't even get that.\nArm the count again once the task state is set and before the work list\nis checked, for the rings whose local work this task is the one to run.", "A flaw was found in the Linux kernel's io_uring subsystem. This flaw allows a local user to cause a Denial of Service (DoS) due to a race condition in the request cancellation mechanism. When a process terminates or executes a new program, a wake-up notification can be missed before the task enters a sleep state, causing the process to hang indefinitely while waiting for pending operations."], "name": "CVE-2026-99253", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-10", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}], "public_date": "2026-11-03T11:20:12Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99253\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99253\nhttps://git.kernel.org/stable/c/aaa06bb9fc03384f7cf2dbc3e43f2939cc7791b2"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d46ab2c98ababa19b41a5709b6921d7b1add7f74,aaa06bb9fc03384f7cf2dbc3e43f2939cc7791b2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.14,7.3.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d46ab2c98ababa19b41a5709b6921d7b1add7f74,aaa06bb9fc03384f7cf2dbc3e43f2939cc7791b2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.14,7.3.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-11-03T12:30:14.941229+00:00", "updated": "2026-11-05T17:15:07.764187+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}