SB20261029192 - Infinite loop in Linux kernel io_uring

Description

This security bulletin contains information about 1 vulnerability.

1) Infinite loop (CVE-ID: CVE-2026-99130)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through sustained CPU consumption or a kernel panic.

The vulnerability exists due to an infinite loop in the Linux kernel's io_uring_cancel_generic() function when an exiting task waits on pending local work that only another task may execute. A local user can create a disabled IORING_SETUP_DEFER_TASKRUN ring, have a child enable it and stop, post work using IORING_OP_MSG_RING, and exit with a request in flight that only the child can complete to make the exiting thread spin continuously without sleeping.

The kernel-panic outcome requires panic_on_warn to be set.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/3005459e0ddfcef0f555b6e81f672f2c49a1c0aa
• https://git.kernel.org/stable/c/94d13387b96e50a4288f7bbdfe401189246a11a1
• https://git.kernel.org/stable/c/fddcf4c5321b3ea5f72166c3fd36a9d1c34f80c7