73 matches found
PT-2026-117077
In the Linux kernel, the following vulnerability has been resolved: io uring: fix task work add use-after-free with SQPOLL For SQPOLL, the sqpoll thread runs task work off its own list and doesn't need to be told about it, so it can pop and complete a request as soon as mpscq push has published i...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: iouring: Fixed a null-ptr-deref in iotctxexitcb. Syzkaller reports a NULL deref bug as follows: BUG: KASAN: null-ptr-deref in iotctxexitcb+0x53/0xd3 Read of size 4 at address 0000000000000138 by task file1/1955 CPU: 1 PID: 195...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: A race condition between handleposixcputimers and posixcputimerdel has been fixed. If a task that exits without autoreaping has already called exitnotify and calls handleposixcputimers from the IRQ, it can be...
SUSE CVE-2026-92486
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix CFI mismatch in task work callback BPF subprograms use the bpfcallbackt ABI, but task work invokes the callback through a three-argument function pointer. This trips kCFI. Store and invoke the callback as bpfcallbackt...
Linux Distros Unpatched Vulnerability : CVE-2026-92486
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Fix CFI mismatch in task work callback BPF subprograms use the bpfcallbackt ABI, but task work invokes the callback through a three-argument function...
DEBIAN-CVE-2026-92486
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix CFI mismatch in task work callback BPF subprograms use the bpfcallbackt ABI, but task work invokes the callback through a three-argument function pointer. This trips kCFI. Store and invoke the callback as bpfcallbackt...
CVE-2026-92486 bpf: Fix CFI mismatch in task work callback
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix CFI mismatch in task work callback BPF subprograms use the bpfcallbackt ABI, but task work invokes the callback through a three-argument function pointer. This trips kCFI. Store and invoke the callback as bpfcallbackt...
CVE-2026-92486
CVE-2026-92486 affects the Linux kernel BPF subsystem. The root cause is a kCFI (kernel Control Flow Integrity) mismatch : BPF subprograms use the bpf_callback_t ABI, but the task work mechanism invokes the callback through a three-argument function pointer, causing a CFI violation. The fix store...
EUVD-2026-82107
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix CFI mismatch in task work callback BPF subprograms use the bpfcallbackt ABI, but task work invokes the callback through a three-argument function pointer. This trips kCFI. Store and invoke the callback as bpfcallbackt...
CVE-2026-92486: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix CFI mismatch in task work callback BPF subprograms use the bpfcallbackt ABI, but task work invokes the callback through a three-argument function pointer. This trips kCFI. Store and invoke the callback as bpfcallbackt...
PT-2026-94794
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subprograms where a Control Flow Integrity CFI mismatch occurs during task work callbacks. While BPF subprograms utilize the bpf callback t ABI, task work...
Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerabilities have been resolved: perf: Fixed event leakage upon execution and file release The pending task work related to perf is never waited for when a matching event occurs. In the case of a child event released directly via freeevent, this can potential...
CVE-2026-81010
A flaw was found in the Linux kernel's iouring/waitid component. The iowaitidcb function, when running from a kernel worker, fails to properly acknowledge task work cancellation. This oversight causes the dowait function to execute within an incorrect task context, which is critical as waitid...
PT-2026-90140
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the io uring/waitid component where the io waitid cb function fails to honor task work cancellation. When task work add cannot queue work to the originating task, the...
CVE-2026-64262 fuse-uring: end fuse_req on io-uring cancel task work
In the Linux kernel, the following vulnerability has been resolved: fuse-uring: end fusereq on io-uring cancel task work When iouring delivers task work with tw.cancel set PFEXITING, PFKTHREAD fallback, or percpurefisdying on the ring context, fuseuringsendintask takes the cancel branch, assigns...
EUVD-2026-13611
In the Linux kernel, the following vulnerability has been resolved: iouring: ensure ctx-rings is stable for task work flags manipulation If DEFERTASKRUN | SETUPTASKRUN is used and task work is added while the ring is being resized, it's possible for the OR'ing of IORINGSQTASKRUN to happen in the...
CVE-2026-23275 io_uring: ensure ctx->rings is stable for task work flags manipulation
In the Linux kernel, the following vulnerability has been resolved: iouring: ensure ctx-rings is stable for task work flags manipulation If DEFERTASKRUN | SETUPTASKRUN is used and task work is added while the ring is being resized, it's possible for the OR'ing of IORINGSQTASKRUN to happen in the...
CVE-2026-23275 io_uring: ensure ctx->rings is stable for task work flags manipulation
In the Linux kernel, the following vulnerability has been resolved: iouring: ensure ctx-rings is stable for task work flags manipulation If DEFERTASKRUN | SETUPTASKRUN is used and task work is added while the ring is being resized, it's possible for the OR'ing of IORINGSQTASKRUN to happen in the...
CVE-2026-23275
CVE-2026-23275 (Linux kernel, io_uring): The issue arises when DEFER_TASKRUN | SETUP_TASKRUN are used and task work is added while the ring is resized, allowing an overlap window where IORING_SQ_TASKRUN could be OR’ed on the old/new rings during swapping. The fix adds a 2nd rings pointer, →rings_...
CVE-2026-23275
In the Linux kernel, the following vulnerability has been resolved: iouring: ensure ctx-rings is stable for task work flags manipulation If DEFERTASKRUN | SETUPTASKRUN is used and task work is added while the ring is being resized, it's possible for the OR'ing of IORINGSQTASKRUN to happen in the...