Read the docs
TI-2026-84205 Aliases CVE-2026-99243GHSA-f2f3-p4r7-62cx

Missing memory barrier in Linux kernel io-wq exit path

Priority LOW 22Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Partial Red Hat: 4 without a fix

No CVSS vector from any source. Fix status from CNA and Red Hat.

Summary

The Linux kernel io-wq component is affected from 5.15.11 before 5.15.224, and from 5.16 until the branch fixes listed in the sources. In io_wq_exit_start(), the exit bit is set without a memory barrier, so the exiting task can read the queued task work before the bit store is visible. A queued worker creation entry then stays queued, and the exit path waits indefinitely.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

In the Linux kernel, the following vulnerability has been resolved: io-wq: order the exit bit against worker creation task work io_wq_exit_workers() cancels task work for queued worker creation with task_work_cancel_match(). That has a plain load of task->task_works. io_queue_worker_create() adds the new entry and tests IO_WQ_BIT_EXIT to cancel it if the workqueue is already on its way out. That must be ordered. task_work_add() has a full barrier via cmpxchg(). But io_wq_exit_start() sets the bit with set_bit() which doesn't have any memory ordering. So afaict, on weakly ordered architectures the exiting task may load task_works before the store of the bit is visible. The other side tests the bit before the store is visible as well. So the entry remains queued with worker_refs and the exiting task waits on worker_done indefinitely. If the task still has rings then io_uring_del_tctx_node() provides the barrier via test_and_set_bit() in io_wq_set_exit_on_idle(). When it has closed all rings though that barrier is gone. Add the barrier after the set_bit().

Why it matters now

EPSS 0.00202 10th percentileScored 2026-11-04
Fix Partial Linux (Linux): 5.15.224, 6.1.191, 6.6.161 +5Red Hat: 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
LinuxLinux5.15.11 to before 5.15.2245.15.224Patch availableCNA
LinuxLinux5.16 and later5.15.224, 6.1.191, 6.6.161, 6.12.115, 6.18.60, 7.2.14, 7.3.1, 7.4-rc1Patch availableCNA
  • Linux VendorLinux Affected 5.15.11 to before 5.15.224 Fixed in 5.15.224 Patch available CNA
  • Linux VendorLinux Affected 5.16 and later Fixed in 5.15.224, 6.1.191, 6.6.161, 6.12.115, 6.18.60, 7.2.14, 7.3.1, 7.4-rc1 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*——Linux
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions — — ·Linux

Remediation

Upgrade to Linux kernel 5.15.224, 6.1.191, 6.6.161, 6.12.115, 6.18.60, 7.2.14, 7.3.1 or 7.4-rc1, or a later release of the same branch. Red Hat lists no available fix plan for Red Hat Enterprise Linux 9 and 10 and OpenShift Container Platform 4 and 5.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA Linux (Linux) Fixed in 5.15.224
  • Fix · CNA Linux (Linux) Fixed in 5.15.224, 6.1.191, 6.6.161, 6.12.115, 6.18.60, 7.2.14, 7.3.1, 7.4-rc1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 5AffectedNo fix yet: Fix deferred
Not affected: 4 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-99243
  2. 2026-11-03 Alias added: GHSA-f2f3-p4r7-62cx
  3. 2026-11-03 Fix available: Linux/Linux@0e5663856b69219ef2f02e04bac9f5c5be19718a, Linux/[email protected] · CNA
  4. 2026-11-03 1 new reference · CNA
  5. 2026-11-04 Affected versions changed · Red Hat
  6. 2026-11-04 CVSS score added · Red Hat

References

Other 8

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2021-02452 Incorrect authorization in Ubuntu linux kernel KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
See all 21741 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences