Linux kernel io_uring: task-work flag write can land on freed rings during a concurrent ring resize

Impact

With DEFER_TASKRUN and SETUP_TASKRUN, task work added while the ring is being resized can OR IORING_SQ_TASKRUN into the old rings in the narrow window between the swap to the new rings and the old ones being freed - a write to freed kernel memory from an interface any unprivileged process can open. io_uring is on the hot path for the storage and network I/O that feeds GPU jobs (dataset loaders, object-store clients, high-throughput serving), so it is reachable from inside ordinary tenant containers unless it has been explicitly disabled. A local user on a shared GPU node is the realistic attacker, and the cost of the fix is a node reboot on a machine that is expensive to drain.

Who can reach it

Local unprivileged process that can call io_uring_setup with DEFER_TASKRUN and then resize its ring. No authentication beyond having a shell or code execution in a container where io_uring is permitted.

What to do

Apply the stable kernel update that adds the RCU-protected ->rings_rcu pointer; three stable branches carry the fix. Rollout is drain, install kernel, reboot each node. Where a reboot cannot be scheduled, blocking io_uring_setup for tenant workloads (seccomp profile, or kernel.io_uring_disabled) closes the path, but it will break any workload that depends on io_uring for I/O.

References

Related entries

• Linux kernel vmwgfx: failed handle lookup returns success, leading to uninitialized and out-of-bounds accessCVE-2026-23317 · Linux kernel vmwgfx (vmw_translate_ptr error path)High
• Linux kernel (drivers/iommu): Unbinding shared virtual addressing touches the mm's IOMMU state after the domain-freeCVE-2026-23429 · Linux kernel (drivers/iommu)High
• Linux kernel NFSD: reads on an open /proc/fs/nfs/exports fd walk a freed export cache after netns teardownCVE-2026-31403 · Linux kernel NFSD (/proc/fs/nfs/exports namespace reference)High
• Linux kernel (net/xfrm): Flushing xfrm states during namespace cleanup re-arms the NAT-keepalive delayed work after itCVE-2026-31406 · Linux kernel (net/xfrm)High
• Linux kernel (crypto algif_aead): Incorrect resource transfer between spheres in algif_aead (reverted to out-of-placeCVE-2026-31431 · Linux kernel (crypto algif_aead)High
• Linux kernel idxd: stale saved-config pointer after a failed second FLR allows invalid memory accessCVE-2026-31442 · Linux kernel dmaengine idxd (saved-config scratch area after FLR)High