Linux kernel io_uring: eventfd signaled inline from a waitqueue wakeup handler can feed back into epoll

Impact

io_req_local_work_add() signals the completion-ring eventfd inline when it is the one to push the first entry onto ->work_list. On DEFER_TASKRUN rings that add is frequently made from a waitqueue wakeup handler, with an arbitrary waitqueue lock held, and eventfd_signal_mask() only declines to recurse when current->in_eventfd is already set - a bit it sets itself. A wake chain that starts elsewhere therefore signals inline and can feed back into epoll while that lock is held. The fix adds IOU_F_TWQ_IN_WAKE and forces those signals down the existing call_rcu_hurry() deferral. On a GPU node the exposure is any local workload permitted to create io_uring rings, which covers tenant containers whose seccomp profile does not block io_uring_setup; io_uring sits under common storage and network fast paths for data loaders and inference servers. The record describes the recursion and the fix but states no observed crash or privilege gain - treat this as a host stability issue, not a boundary break.

Who can reach it

Local. Any process that can call io_uring_setup and register an eventfd, including an unprivileged tenant container whose seccomp profile permits io_uring. No authentication beyond code execution on the node; no remote path.

What to do

Update to a stable kernel containing one of the four linked commits and reboot the node - io_uring is core kernel code, so there is no module reload or hot-patch route. Where tenants do not need it, blocking io_uring_setup in the container seccomp profile or setting kernel.io_uring_disabled removes the exposure without a maintenance window. The record gives commits only, not a fixed release number.

References

Related entries

• Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical
• Incus: instance snapshots bypass restricted.containers.lowlevel, giving command execution on the hostCVE-2026-48751 · Incus (instance snapshots ignore restricted.containers.lowlevel)Critical
• VMware ESXi (OpenSLP): Use-after-free in OpenSLP on port 427 - unauthenticated remote code execution on the hypervisorCVE-2020-3992 · VMware ESXi (OpenSLP)Critical
• Linux kernel mlx5_core kTLS RX offload: TLS RX resync list corruption: entries are moved by the resync handlerCVE-2021-47215 · Linux kernel mlx5_core kTLS RX offloadCritical
• Linux kernel (drivers/nvme/host): The NVMe/RDMA initiator destroys the queue pair before the connection manager ID, soCVE-2021-47378 · Linux kernel (drivers/nvme/host)Critical
• Linux kernel (net/tls): KTLS stored a negative errno into the socket error field where a positive value is expected. ACVE-2021-47496 · Linux kernel (net/tls)Critical