In the Linux kernel, the following vulnerability has been resolved: iouring: don't flood a cancelling task with taskwork ioringexitwork()…
CVE-2026-99254
In the Linux kernel, the following vulnerability has been resolved: iouring: don't flood a cancelling task with taskwork ioringexitwork() asks each task which has used the ring to remove its tctx node, by taskwork, and repeats that until the list is empty. iotctxexitcb() doesn't touch the node while the task is in iouringcancelgeneric(), which removes all the nodes at its end. So the work item queues the callback again as soon as it has completed, for nothing. That is more than a waste of time. taskworkrun() only returns when it finds the list empty. If the rings are released from inside the cancellation, because requests of other rings held the last references to their files, up to 64 work items keep sending callbacks to the one task which is running them. It never finds the list empty, never gets back to the cancellation, the nodes stay, and so it goes on: a task with 60 pairs of rings which poll each other ran 280000 callbacks in 5 seconds, 20 seconds after exitgroup(). It ends when all the senders happen to be late at the same time. Until then the task keeps a CPU and the work items busy. An exiting task can't be killed meanwhile. execve() cancels the requests in the same way,…
Assessment
- CVSS
- Not yet scored
- Severity
- Unscored
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 3 November 2026
- Last updated
- 3 November 2026
- Assigner
- Linux
At the source
References
- https://git.kernel.org/stable/c/a22fb44e988b01b82235ea07f0bf0fc73e256596
- https://git.kernel.org/stable/c/2c75ebae8a7f09c99e31c7042b7d4d595f03b2b1
- https://git.kernel.org/stable/c/61c761fc21e00e45c33c2bb596be442d92fb8792
- https://git.kernel.org/stable/c/14f56e9c0b8fdc2e178acdbec9781e90ef46f7e9
- https://git.kernel.org/stable/c/abdc57c7ebabaaf0b622178a6a85834e1e54ff80
- https://git.kernel.org/stable/c/22e643e61b9b6299b42ff7d88bab48bccada8a5d
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-99254