CVE-2026-81010: io_uring/waitid: honor task_work cancellation
In the Linux kernel, the following vulnerability has been resolved:
iouring/waitid: honor taskwork cancellation
iowaitidcb() may run through the fallback taskwork path when taskworkadd() can no longer queue work to the originating task. The fallback runs from a kworker and iouring marks such task work as canceled through tw.cancel.
iowaitidcb() currently ignores tw.cancel and calls dowait(). waitid is task-context dependent: dowait() performs child lookup relative to current, and the retry path also uses current->signal->waitchldexit. If the callback runs from the fallback kworker, current is therefore not the task that submitted the request.
Honor tw.cancel before entering dowait(). Complete the request with -ECANCELED and skip the siginfo copy, since canceled task work may run without the submitting task's userspace execution context.
Keep the existing siginfo handling for normal waitid completion and explicit cancellation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In io_uring/waitid, honor tw.cancel before entering __do_wait(); when the task work is canceled, complete the request with -ECANCELED and skip the siginfo copy, while retaining existing siginfo handling for normal waitid completion and explicit cancellation.
Event History
Frequently Asked Questions
How are requests handled after the fix when task work has been canceled and executes through the fallback path?
The request is completed with -ECANCELED before __do_wait() is entered. Siginfo is not copied for that canceled fallback execution.
Does this change siginfo handling for ordinary waitid completions?
No. Existing siginfo handling is retained for normal waitid completion and explicit cancellation.