Linux kernel io_uring/waitid: canceled task work runs __do_wait() in the wrong task context

Impact

io_waitid_cb() ignored the tw.cancel flag, so when the fallback task_work path runs the callback from a kworker, __do_wait() performs its child lookup and retry against current - which is no longer the submitting task. The fix completes such requests with -ECANCELED and skips the siginfo copy, since canceled task work can run without the submitter's userspace context. Exposure is local to a task using io_uring waitid, reached on a teardown path rather than on demand; the record does not characterize an exploitable outcome beyond operating on the wrong task's state. On a shared GPU node the relevance is the same as the other io_uring issues: it is kernel state reachable from any tenant pod that can use io_uring.

Who can reach it

Local user or container task submitting io_uring waitid requests. No remote path and no authentication beyond code execution on the node.

What to do

Take the stable kernel update carrying the fix (two backport commits linked) and reboot the node. Blocking io_uring for untrusted workloads via seccomp or the sysctl removes the exposure in the meantime. No fixed mainline version is stated in the record beyond the commits.

References

Related entries

• Linux kernel Intel Speed Select: unvalidated ioctl indices reach MMIO offsets and NULL instancesCVE-2026-89438 · Linux kernel Intel SST driver (isst_if_common ioctl input validation)Unscored
• Linux kernel iommufd: current IOAS rwsem and reference leaked when the unwind path misses itCVE-2026-89446 · Linux kernel iommufd (IOAS rwsem and object reference left held on xa_store failure)Unscored
• Linux kernel iommufd: reference leak on unmap when an internal access is skippedCVE-2026-89447 · Linux kernel iommufd (object reference leak when skipping internal accesses on unmap)Unscored
• Linux kernel VT-d: ACS not requested under tboot, leaving peer-to-peer DMA isolation offCVE-2026-89448 · Linux kernel iommu/vt-d (ACS request when tboot forces the IOMMU on)Unscored
• Linux kernel Tegra241 CMDQV: oversized guest vSID truncates and aliases the wrong Stream IDCVE-2026-89450 · Linux kernel iommu/tegra241-cmdqv (guest vSID programmed into SID_MATCH)Unscored
• Linux kernel iommu/sva: racing bind can return an SVA handle with a NULL dev pointerCVE-2026-89451 · Linux kernel iommu/sva (shared virtual addressing handle initialization)Unscored