CVE-2026-99254 Saturación de task_work en tarea canceladora de io_uring
En el kernel Linux, io_ring_exit_work() reencola indefinidamente callbacks de task_work hacia una tarea en io_uring_cancel_generic(), que nunca ve la lista vacía y no completa la cancelación. La corrección evita ese reencolado inútil.
CVSS 3.1 · PRELIMINAR
- Probabilidad de explotación · EPSS del 09/110,2 % · percentil 9
- Explotada activamenteNo confirmada
- Exploit públicoNo conocido
Afectados
Linux
desde d56d938b4bef3e1421a42023cdcd6e13c1f50831 hasta antes de a22fb44e988b01b82235ea07f0bf0fc73e256596desde d56d938b4bef3e1421a42023cdcd6e13c1f50831 hasta antes de 2c75ebae8a7f09c99e31c7042b7d4d595f03b2b1desde d56d938b4bef3e1421a42023cdcd6e13c1f50831 hasta antes de 61c761fc21e00e45c33c2bb596be442d92fb8792desde d56d938b4bef3e1421a42023cdcd6e13c1f50831 hasta antes de 14f56e9c0b8fdc2e178acdbec9781e90ef46f7e9desde d56d938b4bef3e1421a42023cdcd6e13c1f50831 hasta antes de abdc57c7ebabaaf0b622178a6a85834e1e54ff80desde d56d938b4bef3e1421a42023cdcd6e13c1f50831 hasta antes de f334e79a11e084713e82402b1a7a0e321526992adesde d56d938b4bef3e1421a42023cdcd6e13c1f50831 hasta antes de 22e643e61b9b6299b42ff7d88bab48bccada8a5d
Linux
5.12
Qué hacer
- Verificá si usás Linux y en qué versión.
- Actualizá a la versión corregida que indique el fabricante en su aviso o aplicá su mitigación.
- Revisá registros y accesos de los sistemas expuestos para descartar un uso previo.
Calculadora CVSS
Esta vulnerabilidad todavía no tiene vector CVSS publicado.
Descripción original
In the Linux kernel, the following vulnerability has been resolved:
io_uring: don't flood a cancelling task with task_work
io_ring_exit_work() asks each task which has used the ring to remove its
tctx node, by task_work, and repeats that until the list is empty.
io_tctx_exit_cb() doesn't touch the node while the task is in
io_uring_cancel_generic(), which removes all the nodes at its end. So the
work item queues the callback again as soon as it has completed, for
nothing.
That is more than a waste of time. task_work_run() only returns when it
finds the list empty. If the rings are released from inside the
cancellation, because requests of other rings held the last references to
their files, up to 64 work items keep sending callbacks to the one task
which is running them. It never finds the list empty, never gets back to
the cancellation, the nodes stay, and so it goes on: a task with 60 pairs
of rings which poll each other ran 280000 callbacks in 5 seconds, 20
seconds after exit_group(). It ends when all the senders happen to be late
at the same time. Until then the task keeps a CPU and the work items busy.
An exiting task can't be killed meanwhile. execve() cancels the requests in
the same way, so a live task can get stuck there as well, for minutes. If
it takes more than five, the work items run into the
WARN_ON_ONCE(time_after(jiffies, timeout)) of io_ring_exit_work(). No
privilege is needed for any of this.
If the callback has met a task in cancellation, wait a little before it is
sent again. Nobody has to wake the work item up for that: either the node
is gone by then, or it is the turn of the next round.
Referencias (7)
- git.kernel.org/stable/c/a22fb44e988b01b82235ea07f0bf0fc73e256596
- git.kernel.org/stable/c/2c75ebae8a7f09c99e31c7042b7d4d595f03b2b1
- git.kernel.org/stable/c/61c761fc21e00e45c33c2bb596be442d92fb8792
- git.kernel.org/stable/c/14f56e9c0b8fdc2e178acdbec9781e90ef46f7e9
- git.kernel.org/stable/c/abdc57c7ebabaaf0b622178a6a85834e1e54ff80
- git.kernel.org/stable/c/f334e79a11e084713e82402b1a7a0e321526992a
- git.kernel.org/stable/c/22e643e61b9b6299b42ff7d88bab48bccada8a5d
Resumen traducido automáticamente de la descripción original. Fuente: Nureq Monitor. Cómo funciona.