SB2026040654 - Race condition in Linux kernel io_uring

Description

This security bulletin contains information about 1 vulnerability.

1) Race condition (CVE-ID: CVE-2026-23473)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a wakeup race in io_uring multishot recv polling when processing socket wakeups and shutdown state changes. A local user can trigger back-to-back socket send and shutdown events to cause a denial of service.

The issue can cause the multishot recv operation to hang indefinitely because the shutdown event may be lost and no further wakeups occur.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0f4ce79b8db7b040373fc664c8bc6c5fd74bd196
• https://git.kernel.org/stable/c/a68ed2df72131447d131531a08fe4dfcf4fa4653
• https://git.kernel.org/stable/c/bf33554b6abf7e7faeadd8af1b82037ea755a6bb