CVE-2026-98858: io_uring: fix task_work add use-after-free with SQPOLL
In the Linux kernel, the following vulnerability has been resolved:
iouring: fix taskwork add use-after-free with SQPOLL
For SQPOLL, the sqpoll thread runs taskwork off its own list and doesn't need to be told about it, so it can pop and complete a request as soon as mpscqpush() has published it. If that was the last request holding the ring alive, ioringexitwork() then frees the ctx, stops the thread, and with it the tctx, while ioreqnormalworkadd() is still looking at both after the push:
BUG: KASAN: slab-use-after-free in ioreqnormalworkadd+0x439/0x510 Read of size 4 at addr ff11000000ca0000 by task repro/55 (...) BUG: KASAN: slab-use-after-free in queueworkon+0x25/0x70 Write of size 8 at addr ff11000000c3bd00 by task repro/55
Hold an RCU read lock across the add, like ioreqlocalworkadd() already does, and have ioringexitwork() wait for a grace period for SQPOLL rings as well before freeing the ctx.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
For SQPOLL io_uring rings, hold an RCU read lock across task-work addition, and have io_ring_exit_work() wait for an RCU grace period before freeing the context.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Linux kernel systems using io_uring rings configured with SQPOLL are exposed to the affected race. The issue specifically involves the SQPOLL thread processing task_work while a ring is being torn down.
What conditions are needed to trigger the use-after-free?
A request must be published to the SQPOLL task_work queue while teardown can free the io_uring context. The race is most relevant when that request is the last one keeping the ring alive, allowing io_ring_exit_work() to stop the SQPOLL thread and free associated state during task_work submission.
How is the issue fixed?
The fix holds an RCU read lock across task_work addition and makes io_ring_exit_work() wait for an RCU grace period before freeing the context for SQPOLL rings. The referenced stable kernel commits contain the available fixes.