CVE-2026-99254
kernel: kernel: Denial of Service via task_work flood during cancellation in io_uring
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · November 3, 2026
Updated · November 5, 2026
Description
A flaw was found in the Linux kernel's io_uring subsystem. An unprivileged local user could cause a Denial of Service (DoS) by creating multiple interdependent asynchronous I/O rings and initiating task termination or cancellation. During cleanup, the kernel repeatedly floods the cancelling process with work callbacks, preventing it from completing its exit routines. This behavior results in high CPU utilization and causes the affected process to hang in an unkillable state for prolonged periods.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 3.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CWE-835 · Loop with Unreachable Exit Condition