CVE-2026-80920 (GCVE-0-2026-80920)
Vulnerability from cvelistv5 – Published: 2026-09-09 16:13 – Updated: 2026-09-09 16:13
VLAI
EPSS
VEX
Title
io_uring: defer eventfd signaling when queued from a wakeup handler
Summary
In the Linux kernel, the following vulnerability has been resolved:
io_uring: defer eventfd signaling when queued from a wakeup handler
io_req_local_work_add() signals the CQ ring eventfd inline when it is the
one to push the first entry onto ->work_list. For DEFER_TASKRUN rings that
add is frequently done from a waitqueue wakeup handler, where an
arbitrary waitqueue lock is held.
eventfd_signal_mask() only refuses to recurse when current->in_eventfd
is set, but that bit is set by eventfd_signal_mask() itself. If the wake
chain starts somewhere else, signal goes out inline and can feed back
into epoll.
Add IOU_F_TWQ_IN_WAKE, set it on the task_work add done from the three
waitqueue callbacks, and use it to force io_eventfd_signal() down the
existing call_rcu_hurry() deferral instead of signaling inline.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
21a091b970cdbcf3e8ff829234b51be6f9192766 , < e22f4494cc9487d326e5e3067f33dea7c1e442b2
(git)
Affected: 21a091b970cdbcf3e8ff829234b51be6f9192766 , < b6bb334b0e9348887e3e55e1f494b0c3b8fbf59f (git) Affected: 21a091b970cdbcf3e8ff829234b51be6f9192766 , < 40b6ccf68731809ceb85c6e9f0f8f2ed61c7aa5a (git) Affected: 21a091b970cdbcf3e8ff829234b51be6f9192766 , < cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e (git) |
guessed | |
| Linux | Linux |
Affected:
6.1
Unaffected: 0 , < 6.1 (semver) Unaffected: 6.18.49 , ≤ 6.18.* (semver) Unaffected: 7.1.11 , ≤ 7.1.* (semver) Unaffected: 7.2.1 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/io_uring_types.h",
"io_uring/eventfd.c",
"io_uring/eventfd.h",
"io_uring/futex.c",
"io_uring/io_uring.c",
"io_uring/poll.c",
"io_uring/tw.c",
"io_uring/waitid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e22f4494cc9487d326e5e3067f33dea7c1e442b2",
"status": "affected",
"version": "21a091b970cdbcf3e8ff829234b51be6f9192766",
"versionType": "git"
},
{
"lessThan": "b6bb334b0e9348887e3e55e1f494b0c3b8fbf59f",
"status": "affected",
"version": "21a091b970cdbcf3e8ff829234b51be6f9192766",
"versionType": "git"
},
{
"lessThan": "40b6ccf68731809ceb85c6e9f0f8f2ed61c7aa5a",
"status": "affected",
"version": "21a091b970cdbcf3e8ff829234b51be6f9192766",
"versionType": "git"
},
{
"lessThan": "cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e",
"status": "affected",
"version": "21a091b970cdbcf3e8ff829234b51be6f9192766",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/io_uring_types.h",
"io_uring/eventfd.c",
"io_uring/eventfd.h",
"io_uring/futex.c",
"io_uring/io_uring.c",
"io_uring/poll.c",
"io_uring/tw.c",
"io_uring/waitid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.49",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.11",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.1",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: defer eventfd signaling when queued from a wakeup handler\n\nio_req_local_work_add() signals the CQ ring eventfd inline when it is the\none to push the first entry onto -\u003ework_list. For DEFER_TASKRUN rings that\nadd is frequently done from a waitqueue wakeup handler, where an\narbitrary waitqueue lock is held.\n\neventfd_signal_mask() only refuses to recurse when current-\u003ein_eventfd\nis set, but that bit is set by eventfd_signal_mask() itself. If the wake\nchain starts somewhere else, signal goes out inline and can feed back\ninto epoll.\n\nAdd IOU_F_TWQ_IN_WAKE, set it on the task_work add done from the three\nwaitqueue callbacks, and use it to force io_eventfd_signal() down the\nexisting call_rcu_hurry() deferral instead of signaling inline."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T16:13:17.023Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e22f4494cc9487d326e5e3067f33dea7c1e442b2"
},
{
"url": "https://git.kernel.org/stable/c/b6bb334b0e9348887e3e55e1f494b0c3b8fbf59f"
},
{
"url": "https://git.kernel.org/stable/c/40b6ccf68731809ceb85c6e9f0f8f2ed61c7aa5a"
},
{
"url": "https://git.kernel.org/stable/c/cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e"
}
],
"title": "io_uring: defer eventfd signaling when queued from a wakeup handler",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80920",
"datePublished": "2026-09-09T16:13:17.023Z",
"dateReserved": "2026-08-26T14:34:25.801Z",
"dateUpdated": "2026-09-09T16:13:17.023Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2026-80920\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-09T17:17:47.120\",\"lastModified\":\"2026-09-09T17:17:47.120\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nio_uring: defer eventfd signaling when queued from a wakeup handler\\n\\nio_req_local_work_add() signals the CQ ring eventfd inline when it is the\\none to push the first entry onto -\u003ework_list. For DEFER_TASKRUN rings that\\nadd is frequently done from a waitqueue wakeup handler, where an\\narbitrary waitqueue lock is held.\\n\\neventfd_signal_mask() only refuses to recurse when current-\u003ein_eventfd\\nis set, but that bit is set by eventfd_signal_mask() itself. If the wake\\nchain starts somewhere else, signal goes out inline and can feed back\\ninto epoll.\\n\\nAdd IOU_F_TWQ_IN_WAKE, set it on the task_work add done from the three\\nwaitqueue callbacks, and use it to force io_eventfd_signal() down the\\nexisting call_rcu_hurry() deferral instead of signaling inline.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/linux/io_uring_types.h\",\"io_uring/eventfd.c\",\"io_uring/eventfd.h\",\"io_uring/futex.c\",\"io_uring/io_uring.c\",\"io_uring/poll.c\",\"io_uring/tw.c\",\"io_uring/waitid.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"21a091b970cdbcf3e8ff829234b51be6f9192766\",\"lessThan\":\"e22f4494cc9487d326e5e3067f33dea7c1e442b2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"21a091b970cdbcf3e8ff829234b51be6f9192766\",\"lessThan\":\"b6bb334b0e9348887e3e55e1f494b0c3b8fbf59f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"21a091b970cdbcf3e8ff829234b51be6f9192766\",\"lessThan\":\"40b6ccf68731809ceb85c6e9f0f8f2ed61c7aa5a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"21a091b970cdbcf3e8ff829234b51be6f9192766\",\"lessThan\":\"cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/linux/io_uring_types.h\",\"io_uring/eventfd.c\",\"io_uring/eventfd.h\",\"io_uring/futex.c\",\"io_uring/io_uring.c\",\"io_uring/poll.c\",\"io_uring/tw.c\",\"io_uring/waitid.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.49\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.11\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.1\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/40b6ccf68731809ceb85c6e9f0f8f2ed61c7aa5a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b6bb334b0e9348887e3e55e1f494b0c3b8fbf59f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e22f4494cc9487d326e5e3067f33dea7c1e442b2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…