Race condition in Linux kernel - CVE-2026-99243
Published: November 3, 2026
Vulnerability identifier: #VU158996
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-99243
CWE-ID: CWE-362
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service by leaving an exiting task waiting indefinitely for io_uring workers.
The vulnerability exists due to a race condition caused by missing memory ordering in the Linux kernel io_uring worker queue when worker creation overlaps with task exit on weakly ordered architectures. A local user can trigger concurrent worker creation and task exit after closing all io_uring rings to leave worker-creation task work queued, causing the exiting task to wait indefinitely on worker_done.
Affected software
Linux kernel
How to mitigate CVE-2026-99243
Install security update from vendor's repository.
External References
- https://git.kernel.org/stable/c/0d81cdd433b0a96c5275c01b8172e0b1f71dd595
- https://git.kernel.org/stable/c/1432d881d99584105122760133caeff1dce7a9f7
- https://git.kernel.org/stable/c/31fc780b75b278d37700373d54a99fdb4117fdd6
- https://git.kernel.org/stable/c/67da3eec264aeb67835886720243ae2dc1463315
- https://git.kernel.org/stable/c/6cf012a4d5e461c788ecc9dbed67adc31a142644
- https://git.kernel.org/stable/c/75395db7a9b40a2e826c838e648fef8ed1a2d174
- https://git.kernel.org/stable/c/a63c752157eacf49f628359822666b32503d194a