Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-99268— io_uring: wake ring pollers for local task_work

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： io_uring：为本地任务工作（local task_work）唤醒轮询器（ring pollers）当使用标志时，完成事件会被排列为本地工作（local work），只有当提交者（submitter）进入内核等待事件时，这些工作才会转换为完成队列事件（CQEs）。对于通过或监控轮询文件描述符（ring fd）以判断何时应进入内核等待的应用程序，会在存在待处理的本地工作时报告。但这仅在调用时刻工作已存在时才有效。在引入时，会调用，从而唤醒正在中睡

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 12

Vendor	Product	Version Range	Status
Linux	Linux	`130bd686d9be918e4cc8c03abf5794ba2d860502< 9bb28e7740ce78beecafc5db074b45f4cbeb8a47`	affected
		`130bd686d9be918e4cc8c03abf5794ba2d860502< d8c618747a6aa90022e19ec614aa7157d0302108`	affected
		`130bd686d9be918e4cc8c03abf5794ba2d860502< 2c88d978f1dfd03edf67924ea8fd25cc45499eef`	affected
		`130bd686d9be918e4cc8c03abf5794ba2d860502< 92bfadcbe0a9a001beb5e58a2abaf040b873deb6`	affected
		`130bd686d9be918e4cc8c03abf5794ba2d860502< b88902d8745a701d24275d012f0830e3628e2a22`	affected
		`6.3`	affected
		`< 6.3`	unaffected
		`6.6.161≤ 6.6.*`	unaffected
… +4 more rows

Updated Nov 04, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

io_uring: wake ring pollers for local task_work

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: io_uring: wake ring pollers for local task_work With IORING_SETUP_DEFER_TASKRUN completions are queued as local work, and only become CQEs when the submitter enters the kernel to wait for events. For an application that finds out via poll() or epoll on the ring fd when it is time to do that, io_uring_poll() reports EPOLLIN if local work is pending. That only helps if the work is there at the time of the call. When DEFER_TASKRUN was added, io_req_local_work_add() did io_cqring_wake(), which took care of tasks sleeping in poll() as well. Then polling got a wait queue of its own, ->poll_wq, and the wake up in io_req_local_work_add() was replaced by waking the submitter directly. Since then ->poll_wq is only woken when CQEs are committed, which for such a ring is done by the very task that is waiting to be told to: submitter completion poll(ring_fd) io_uring_poll() // nothing yet schedule() io_req_local_work_add() // ->cq_wait_nr: nobody waits // sleeps on Wake ->poll_wq when the first entry is put on the work list. Like for the eventfd, that must not be done right away if the work is queued from a wake up handler, as the chain of wake ups could get back to the wait queue whose lock is held. Use an RCU callback in that case, with a reference to the ring.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	130bd686d9be918e4cc8c03abf5794ba2d860502 ~ 9bb28e7740ce78beecafc5db074b45f4cbeb8a47	-
Linux	Linux	6.3	-

II. Public POCs for CVE-2026-99268

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-99268

请登录查看更多情报信息。

Other References for CVE-2026-99268 (5)

https://www.cve.org/CVERecord?id=CVE-2026-99268

Same Patch Batch · Linux · 2026-11-03 · 28 CVEs total

CVE-2026-99270	8.1 HIGH	tcp: Fix potential UAF in reqsk_timer_handler().
CVE-2026-99246	8.1 HIGH	tipc: protect node reset trace dump with node lock
CVE-2026-99269	7.8 HIGH	sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs
CVE-2026-99264	7.8 HIGH	io_uring/net: don't retry recv on uncommitted buffers
CVE-2026-99243		io-wq: order the exit bit against worker creation task work
CVE-2026-99245		KEYS: Fix key_reject_and_link() race with keyring restriction
CVE-2026-99244		pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper
CVE-2026-99248		i2c: xiic: restore non-managed runtime PM to fix clk WARN flood
CVE-2026-99247		tracing: Do not initialize tracefs work if tracing is disabled
CVE-2026-99249		pid_namespace: make zap_pid_ns_processes() freezable
CVE-2026-99250		printk: Postpone kthread startup
CVE-2026-99251		Drivers: hv: Avoid infinite retry loop in init_vp_index()
CVE-2026-99252		io_uring/mpscq: disable preemption while pushing
CVE-2026-99253		io_uring/cancel: rearm local work wake up before sleep
CVE-2026-99255		io_uring/io-wq: don't hide a link from cancellations
CVE-2026-99254		io_uring: don't flood a cancelling task with task_work
CVE-2026-99257		gpio: shared: gracefully handle no-device lookup of shared GPIOs
CVE-2026-99256		dm cache: fix issue with background work locking
CVE-2026-99259		soc/tegra: pmc: Fix uninitialised clock rate
CVE-2026-99258		x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()

Showing top 20 of 28 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux