CVE-2026-81010

A flaw was found in the Linux kernel's io_uring/waitid component. The io_waitid_cb() function, when running from a kernel worker, fails to properly acknowledge task work cancellation. This oversight causes the __do_wait() function to execute within an incorrect task context, which is critical as waitid operations are inherently task-context dependent. Consequently, this could lead to unexpected system behavior or issues with process state management.

Red Hat Product Security rates this Linux kernel io_uring flaw as having MODERATE impact. In the io_uring/waitid component, the io_waitid_cb() callback ignores the task_work cancellation flag (tw.cancel) when its task work runs through the fallback path on a kernel worker, which happens when task_work_add() can no longer queue work to the originating task. Because waitid is task-context dependent — __do_wait() performs child lookup relative to current and the retry path uses current->signal->wait_chldexit — the wait executes in the wrong task context, which can lead to system instability or a kernel panic and therefore a local denial of service (CVSS 3.1: 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Red Hat's severity is lower than the CVE.org score of 7.8 (IMPORTANT) because the assessed impact is limited to availability, with no direct impact on confidentiality or integrity. Affected products include Red Hat Enterprise Linux 9 and 10 kernel streams and OpenShift Container Platform 4 (via the RHEL CoreOS 9 kernel); older Red Hat Enterprise Linux streams and earlier OpenShift releases are not affected because the vulnerable code is not present in those versions. For the affected streams, the fix is deferred: with MODERATE impact and a CVSS score below 7.0, trackers are not being filed for these streams at this time. The residual risk is that a local user able to submit io_uring waitid requests and trigger the fallback task_work path could crash the system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.