CVE-2026-23275
published 2026-03-20CVE-2026-23275: In the Linux kernel, the following vulnerability has been resolved: io_uring: ensure ctx->rings is stable for task work flags manipulation If DEFER_TASKRUN |…
PriorityP337high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.12%
2.3th percentile
In the Linux kernel, the following vulnerability has been resolved:
io_uring: ensure ctx->rings is stable for task work flags manipulation
If DEFER_TASKRUN | SETUP_TASKRUN is used and task work is added while
the ring is being resized, it's possible for the OR'ing of
IORING_SQ_TASKRUN to happen in the small window of swapping into the
new rings and the old rings being freed.
Prevent this by adding a 2nd ->rings pointer, ->rings_rcu, which is
protected by RCU. The task work flags manipulation is inside RCU
already, and if the resize ring freeing is done post an RCU synchronize,
then there's no need to add locking to the fast path of task work
additions.
Note: this is only done for DEFER_TASKRUN, as that's the only setup mode
that supports ring resizing. If this ever changes, then they too need to
use the io_ctx_mark_taskrun() helper.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.19.10-1 (forky) | linux 6.19.10-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= 79cfe9e59c2a12c3b3faeeefe38d23f3d8030972 < 7cc4530b3e952d4a5947e1e55d06620d8845d4f5 | 7cc4530b3e952d4a5947e1e55d06620d8845d4f5 |
| linux | linux | >= 79cfe9e59c2a12c3b3faeeefe38d23f3d8030972 < 46dc07d5f31411cc023f3bf1f4a23a07bf6e0ed1 | 46dc07d5f31411cc023f3bf1f4a23a07bf6e0ed1 |
| linux | linux | >= 79cfe9e59c2a12c3b3faeeefe38d23f3d8030972 < 96189080265e6bb5dde3a4afbaf947af493e3f82 | 96189080265e6bb5dde3a4afbaf947af493e3f82 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.19.10-1 | 6.19.10-1 |
| linux | linux_kernel | >= 6.13 < 6.18.19 | 6.18.19 |
| linux | linux_kernel | >= 6.13.0 < 6.18.19 | 6.18.19 |
| linux | linux_kernel | >= 6.19 < 6.19.9 | 6.19.9 |
| linux | linux_kernel | >= 6.19.0 < 6.19.9 | 6.19.9 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8LOW
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 6.18.18/6.19.8/7.0-rc3 io_uring io_ctx_mark_taskrun privilege escalation (EUVD-2026-13611 / Nessus ID 303223)
vuldb·2026-05-23·CVSS 7.8
CVE-2026-23275 [HIGH] Linux Kernel up to 6.18.18/6.19.8/7.0-rc3 io_uring io_ctx_mark_taskrun privilege escalation (EUVD-2026-13611 / Nessus ID 303223)
A vulnerability labeled as problematic has been found in Linux Kernel up to 6.18.18/6.19.8/7.0-rc3. This issue affects the function io_ctx_mark_taskrun of the component io_uring. The manipulation results in privilege escalation.
This vulnerability is identified as CVE-2026-23275. The attack can only be performed from the local network. There is not any exploit available.
The affected component should be upgraded.
OSV
io_uring: ensure ctx->rings is stable for task work flags manipulation
osv·2026-03-20·CVSS 7.8
CVE-2026-23275 [HIGH] io_uring: ensure ctx->rings is stable for task work flags manipulation
io_uring: ensure ctx->rings is stable for task work flags manipulation
In the Linux kernel, the following vulnerability has been resolved:
io_uring: ensure ctx->rings is stable for task work flags manipulation
If DEFER_TASKRUN | SETUP_TASKRUN is used and task work is added while
the ring is being resized, it's possible for the OR'ing of
IORING_SQ_TASKRUN to happen in the small window of swapping into the
new rings and the old rings being freed.
Prevent this by adding a 2nd ->rings pointer, ->rings_rcu, which is
protected by RCU. The task work flags manipulation is inside RCU
already, and if the resize ring freeing is done post an RCU synchronize,
then there's no need to add locking to the fast path of task work
additions.
Note: this is only done for DEFER_TASKRUN, as that's the only s
OSV
CVE-2026-23275: In the Linux kernel, the following vulnerability has been resolved: io_uring: ensure ctx->rings is stable for task work flags manipulation If DEFER_TA
osv·2026-03-20·CVSS 7.8
CVE-2026-23275 [HIGH] CVE-2026-23275: In the Linux kernel, the following vulnerability has been resolved: io_uring: ensure ctx->rings is stable for task work flags manipulation If DEFER_TA
In the Linux kernel, the following vulnerability has been resolved: io_uring: ensure ctx->rings is stable for task work flags manipulation If DEFER_TASKRUN | SETUP_TASKRUN is used and task work is added while the ring is being resized, it's possible for the OR'ing of IORING_SQ_TASKRUN to happen in the small window of swapping into the new rings and the old rings being freed. Prevent this by adding a 2nd ->rings pointer, ->rings_rcu, which is protected by RCU. The task work flags manipulation is inside RCU already, and if the resize ring freeing is done post an RCU synchronize, then there's no need to add locking to the fast path of task work additions. Note: this is only done for DEFER_TASKRUN, as that's the only setup mode that supports ring resizing. If this ever changes, then they too n
GHSA
GHSA-w9fp-2248-jh3m: In the Linux kernel, the following vulnerability has been resolved:
io_uring: ensure ctx->rings is stable for task work flags manipulation
If DEFER_
ghsa_unreviewed·2026-03-20
CVE-2026-23275 [HIGH] GHSA-w9fp-2248-jh3m: In the Linux kernel, the following vulnerability has been resolved:
io_uring: ensure ctx->rings is stable for task work flags manipulation
If DEFER_
In the Linux kernel, the following vulnerability has been resolved:
io_uring: ensure ctx->rings is stable for task work flags manipulation
If DEFER_TASKRUN | SETUP_TASKRUN is used and task work is added while
the ring is being resized, it's possible for the OR'ing of
IORING_SQ_TASKRUN to happen in the small window of swapping into the
new rings and the old rings being freed.
Prevent this by adding a 2nd ->rings pointer, ->rings_rcu, which is
protected by RCU. The task work flags manipulation is inside RCU
already, and if the resize ring freeing is done post an RCU synchronize,
then there's no need to add locking to the fast path of task work
additions.
Note: this is only done for DEFER_TASKRUN, as that's the only setup mode
that supports ring resizing. If this ever changes, then they t
Red Hat
kernel: io_uring: ensure ctx->rings is stable for task work flags manipulation
vendor_redhat·2026-03-20·CVSS 7.8
CVE-2026-23275 [HIGH] CWE-366 kernel: io_uring: ensure ctx->rings is stable for task work flags manipulation
kernel: io_uring: ensure ctx->rings is stable for task work flags manipulation
In the Linux kernel, the following vulnerability has been resolved:
io_uring: ensure ctx->rings is stable for task work flags manipulation
If DEFER_TASKRUN | SETUP_TASKRUN is used and task work is added while
the ring is being resized, it's possible for the OR'ing of
IORING_SQ_TASKRUN to happen in the small window of swapping into the
new rings and the old rings being freed.
Prevent this by adding a 2nd ->rings pointer, ->rings_rcu, which is
protected by RCU. The task work flags manipulation is inside RCU
already, and if the resize ring freeing is done post an RCU synchronize,
then there's no need to add locking to the fast path of task work
additions.
Note: this is only done for DEFER_TASKRUN, as that's the on
Debian
CVE-2026-23275: linux - In the Linux kernel, the following vulnerability has been resolved: io_uring: e...
vendor_debian·2026·CVSS 7.8
CVE-2026-23275 [HIGH] CVE-2026-23275: linux - In the Linux kernel, the following vulnerability has been resolved: io_uring: e...
In the Linux kernel, the following vulnerability has been resolved: io_uring: ensure ctx->rings is stable for task work flags manipulation If DEFER_TASKRUN | SETUP_TASKRUN is used and task work is added while the ring is being resized, it's possible for the OR'ing of IORING_SQ_TASKRUN to happen in the small window of swapping into the new rings and the old rings being freed. Prevent this by adding a 2nd ->rings pointer, ->rings_rcu, which is protected by RCU. The task work flags manipulation is inside RCU already, and if the resize ring freeing is done post an RCU synchronize, then there's no need to add locking to the fast path of task work additions. Note: this is only done for DEFER_TASKRUN, as that's the only setup mode that supports ring resizing. If this ever changes, then they too n
No detection rules found.
No public exploits indexed.
2026-03-20
Published