CVE-2026-46274

A flaw was found in the Linux kernel's input/output work queue (io-wq) component. This vulnerability occurs because the system incorrectly handles work queue entries, leading to a stale pointer. A local attacker could exploit this issue by manipulating work queue operations. Successful exploitation could allow the attacker to write to freed memory, potentially leading to privilege escalation or a system crash (denial of service).

An io-wq use-after-free can occur when io_wq_remove_pending updates hash_tail for a hashed bucket-0 work item using a predecessor that is not hashed. A non-hashed predecessor can then be dequeued without clearing hash_tail, later freed back to req_cachep, and the next hashed bucket-0 enqueue can write through the dangling pointer. For the CVSS the PR:L because a local user or local process with access to io_uring is needed to create and cancel the relevant work items. Impact is at least local denial of service via kernel crash and may allow privilege escalation because the primitive is a kernel use-after-free with a write through freed memory. For the Red Hat Enterprise Linux the related Kernel config param CONFIG_IO_WQ disabled, so the bug not actual ("not affected").

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.