In the Linux kernel, the following vulnerability has been resolved: iouring: wake ring pollers for local taskwork With…
CVE-2026-99268
In the Linux kernel, the following vulnerability has been resolved: iouring: wake ring pollers for local taskwork With IORINGSETUPDEFERTASKRUN completions are queued as local work, and only become CQEs when the submitter enters the kernel to wait for events. For an application that finds out via poll() or epoll on the ring fd when it is time to do that, iouringpoll() reports EPOLLIN if local work is pending. That only helps if the work is there at the time of the call. When DEFERTASKRUN was added, ioreqlocalworkadd() did iocqringwake(), which took care of tasks sleeping in poll() as well. Then polling got a wait queue of its own, ->pollwq, and the wake up in ioreqlocalworkadd() was replaced by waking the submitter directly. Since then ->pollwq is only woken when CQEs are committed, which for such a ring is done by the very task that is waiting to be told to: submitter completion poll(ringfd) iouringpoll() // nothing yet schedule() ioreqlocalworkadd() // ->cqwaitnr: nobody waits // sleeps on Wake ->pollwq when the first entry is put on the work list. Like for the eventfd, that must not be done right away if the work is queued from a wake up handler, as the chain of wake ups could…
Assessment
- CVSS
- Not yet scored
- Severity
- Unscored
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 3 November 2026
- Last updated
- 3 November 2026
- Assigner
- Linux
At the source
References
- https://git.kernel.org/stable/c/9bb28e7740ce78beecafc5db074b45f4cbeb8a47
- https://git.kernel.org/stable/c/d8c618747a6aa90022e19ec614aa7157d0302108
- https://git.kernel.org/stable/c/2c88d978f1dfd03edf67924ea8fd25cc45499eef
- https://git.kernel.org/stable/c/92bfadcbe0a9a001beb5e58a2abaf040b873deb6
- https://git.kernel.org/stable/c/b88902d8745a701d24275d012f0830e3628e2a22
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-99268