UBUNTU-CVE-2026-98858: Use After Free
In the Linux kernel, the following vulnerability has been resolved: iouring: fix taskwork add use-after-free with SQPOLL For SQPOLL, the sqpoll thread runs taskwork off its own list and doesn't need to be told about it, so it can pop and complete a request as soon as mpscqpush() has published it. If that was the last request holding the ring alive, ioringexitwork() then frees the ctx, stops the thread, and with it the tctx, while ioreqnormalworkadd() is still looking at both after the push: BUG: KASAN: slab-use-after-free in ioreqnormalworkadd+0x439/0x510 Read of size 4 at addr ff11000000ca0000 by task repro/55 (...) BUG: KASAN: slab-use-after-free in queueworkon+0x25/0x70 Write of size 8 at addr ff11000000c3bd00 by task repro/55 Hold an RCU read lock across the add, like ioreqlocalworkadd() already does, and have ioringexitwork() wait for a grace period for SQPOLL rings as well before freeing the ctx.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.18~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1019.19~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.19~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.18~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-43.43.1~24.04.2 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-43.43 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1017.18 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1020.21 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1019.19 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1017.19 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1010.11 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1018.18 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1018.18 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-43.43.1 - Compensating control
In the io_uring SQPOLL code, hold an RCU read lock across the add in io_req_normal_work_add(), and make io_ring_exit_work() wait for an RCU grace period before freeing the context.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The affected software list includes Ubuntu kernel packages for riscv, realtime, hwe-edge, Azure, GCP, Azure FDE, GKE, and aws-5.0. The vulnerable path specifically involves io_uring rings using SQPOLL.
What access does an attacker need to exploit it?
The severity vector indicates local attack access, low attack complexity, low privileges required, and no user interaction. Exploitation involves racing task_work submission and ring teardown in the SQPOLL io_uring path.
What is the impact of successful exploitation?
The flaw is a use-after-free affecting the io_uring context and associated SQPOLL thread context. The provided severity vector rates confidentiality, integrity, and availability impact as high.
How was the issue fixed?
The fix holds an RCU read lock while adding task work and makes io_ring_exit_work() wait for an RCU grace period before freeing the context for SQPOLL rings. This prevents the context from being freed while task-work addition still accesses it.