Linux kernel io_uring: eventfd signaled inline from a waitqueue wakeup handler can feed back into epoll

Impact

io_req_local_work_add() signals the completion-ring eventfd inline when it is the one to push the first entry onto ->work_list. On DEFER_TASKRUN rings that add is frequently made from a waitqueue wakeup handler, with an arbitrary waitqueue lock held, and eventfd_signal_mask() only declines to recurse when current->in_eventfd is already set - a bit it sets itself. A wake chain that starts elsewhere therefore signals inline and can feed back into epoll while that lock is held. The fix adds IOU_F_TWQ_IN_WAKE and forces those signals down the existing call_rcu_hurry() deferral. On a GPU node the exposure is any local workload permitted to create io_uring rings, which covers tenant containers whose seccomp profile does not block io_uring_setup; io_uring sits under common storage and network fast paths for data loaders and inference servers. The record describes the recursion and the fix but states no observed crash or privilege gain - treat this as a host stability issue, not a boundary break.

Who can reach it

Local. Any process that can call io_uring_setup and register an eventfd, including an unprivileged tenant container whose seccomp profile permits io_uring. No authentication beyond code execution on the node; no remote path.

What to do

Update to a stable kernel containing one of the four linked commits and reboot the node - io_uring is core kernel code, so there is no module reload or hot-patch route. Where tenants do not need it, blocking io_uring_setup in the container seccomp profile or setting kernel.io_uring_disabled removes the exposure without a maintenance window. The record gives commits only, not a fixed release number.

References

Related entries

• Linux crypto iaa: DMA buffer not unmapped before software fallback corrupts decompressed dataCVE-2026-80945 · Linux kernel crypto/iaa (Intel In-Memory Analytics Accelerator decompress path)Unscored
• Linux fuse io-uring: request headers copied from a non-whitelisted slab object panics hardened usercopyCVE-2026-80946 · Linux kernel FUSE io-uring transport (fuse_request header usercopy)Unscored
• Linux net/smc: connection freed before tasklet drain leaves a use-after-free on the SMC-D receive pathCVE-2026-80979 · Linux kernel net/smc (SMC-D connection teardown vs. rx tasklet)Unscored
• Linux kernel net/smc: oversized SMC-Rv2 LLC messages let a peer delete or install RDMA rkeysCVE-2026-80985 · Linux kernel net/smc (SMC-Rv2 LLC rkey handling)Unscored
• Linux kernel net/smc: out-of-bounds read parsing the v2 extension on every SMC-Rv2 link additionCVE-2026-80986 · Linux kernel net/smc (SMC-Rv2 add-link v2 extension parsing)Unscored
• Linux kernel io_uring/query: unclamped user size lets a local task request ~4 GiB of clear_user zeroingCVE-2026-81009 · Linux kernel io_uring (IORING_REGISTER_QUERY, copy_struct_to_user size cap)Unscored