CVE-2026-97619: io_uring/rw: end write accounting from ->ki_complete

Published Sep 25, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

iouring/rw: end write accounting from ->kicomplete

Commit b000145e9907 moved both the fsnotify calls and the write accounting out of the kiocb completion handler and into the ioreqrwcomplete() taskwork. However, only the fsnotify part actually needed to move as it may sleep. Ending the write accounting is just a percpuupread() on the superblock writers sem.

Deferring it is a problem, because it makes dropping SBFREEZEWRITE protection depend on the ring owner getting to running taskwork. But the task may be blocked in freezesuper(), causing it to never get to that:

task io-wq worker -------------------------------------------------------------- iowrite() iokiocbstartwrite() (takes sbwriters, hidden from lockdep by sbwritersrelease) writeiter() -> -EIOCBQUEUED ioctl(FSIOCSHUTDOWN) bdevfreeze() freezesuper() percpudownwrite() <- waits for the reader above iowrite() kiocbstartwrite() percpudownread() <- queued behind the writer <bio completes> iocompleterw() queues ioreqrwcomplete() <- never runs, task is in D state

End the write from iocompleterw() instead, and leave only the fsnotify calls in taskwork.

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 25, 2026
CVE Published
via MITRE·10:22 AM
Data Sourced
via MITRE·10:22 AM
Description
Data Sourced
via NVD·11:17 AM
Description

Frequently Asked Questions

1

What conditions are needed to trigger the deadlock?

An io_uring write must start write accounting and complete asynchronously after write_iter() returns -EIOCBQUEUED. A filesystem or block-device freeze operation must then wait for the superblock writers semaphore while completion work remains queued for the ring owner.

2

Which systems are most exposed?

Systems that use io_uring asynchronous writes and can concurrently invoke filesystem or block-device shutdown/freezing operations are exposed to this condition. The described path includes FS_IOC_SHUTDOWN, bdev_freeze(), and freeze_super().

3

How could this appear on an affected system?

The ring-owning task can be blocked in freeze_super() in D state while the asynchronous I/O completion queues io_req_rw_complete() task_work that never runs. The freeze waits for write protection to be dropped, but that accounting is deferred until the blocked task runs its task_work.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203