SB2026040654 - Race condition in Linux kernel io_uring
Published: April 6, 2026
Security Bulletin ID
SB2026040654
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Race condition (CVE-ID: CVE-2026-23473)
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper handling of a wakeup race in io_uring multishot recv polling when processing socket wakeups and shutdown state changes. A local user can trigger back-to-back socket send and shutdown events to cause a denial of service.
The issue can cause the multishot recv operation to hang indefinitely because the shutdown event may be lost and no further wakeups occur.
Remediation
Install update from vendor's website.