{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-23275",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2026-01-13T15:37:45.991Z",
        "datePublished": "2026-03-20T08:08:55.857Z",
        "dateUpdated": "2026-08-05T12:21:06.046Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-05T12:21:06.046Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: ensure ctx->rings is stable for task work flags manipulation\n\nIf DEFER_TASKRUN | SETUP_TASKRUN is used and task work is added while\nthe ring is being resized, it's possible for the OR'ing of\nIORING_SQ_TASKRUN to happen in the small window of swapping into the\nnew rings and the old rings being freed.\n\nPrevent this by adding a 2nd ->rings pointer, ->rings_rcu, which is\nprotected by RCU. The task work flags manipulation is inside RCU\nalready, and if the resize ring freeing is done post an RCU synchronize,\nthen there's no need to add locking to the fast path of task work\nadditions.\n\nNote: this is only done for DEFER_TASKRUN, as that's the only setup mode\nthat supports ring resizing. If this ever changes, then they too need to\nuse the io_ctx_mark_taskrun() helper."
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 7.8,
                        "baseSeverity": "HIGH"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:L - io_uring is accessed via the io_uring_setup and io_uring_register syscalls, requiring local system access.\nAC:L - The attacker controls both sides of the race — they trigger ring resize while simultaneously causing task work additions. DEFER_TASKRUN+SINGLE_ISSUER means a single task, but completions adding task work happen concurrently with the register syscall.\nPR:L - io_uring is accessible to unprivileged local users by default (sysctl_io_uring_disabled defaults to 0, no capabilities required).\nUI:N - No user interaction is needed; the attacker can set up the io_uring ring with DEFER_TASKRUN and trigger the race entirely on their own.\nS:U - The vulnerability stays within the kernel security boundary; no VM escape or sandbox bypass is involved.\nC:H - This is a use-after-free on the rings structure. The freed memory can be reallocated with attacker-controlled data, potentially enabling arbitrary kernel memory reads.\nI:H - The UAF allows atomic_or on freed/reallocated memory, enabling heap spraying and arbitrary write primitives that could lead to code execution.\nA:H - Accessing freed memory (use-after-free) can cause kernel crashes/oops, and the race can be triggered repeatedly for reliable denial of service."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "include/linux/io_uring_types.h",
                        "io_uring/io_uring.c",
                        "io_uring/register.c",
                        "io_uring/tw.c"
                    ],
                    "versions": [
                        {
                            "version": "79cfe9e59c2a12c3b3faeeefe38d23f3d8030972",
                            "lessThan": "7cc4530b3e952d4a5947e1e55d06620d8845d4f5",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "79cfe9e59c2a12c3b3faeeefe38d23f3d8030972",
                            "lessThan": "46dc07d5f31411cc023f3bf1f4a23a07bf6e0ed1",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "79cfe9e59c2a12c3b3faeeefe38d23f3d8030972",
                            "lessThan": "96189080265e6bb5dde3a4afbaf947af493e3f82",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "include/linux/io_uring_types.h",
                        "io_uring/io_uring.c",
                        "io_uring/register.c",
                        "io_uring/tw.c"
                    ],
                    "versions": [
                        {
                            "version": "6.13",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "6.13",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.18.19",
                            "lessThanOrEqual": "6.18.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.19.9",
                            "lessThanOrEqual": "6.19.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.0",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.13",
                                    "versionEndExcluding": "6.18.19"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.13",
                                    "versionEndExcluding": "6.19.9"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.13",
                                    "versionEndExcluding": "7.0"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/7cc4530b3e952d4a5947e1e55d06620d8845d4f5"
                },
                {
                    "url": "https://git.kernel.org/stable/c/46dc07d5f31411cc023f3bf1f4a23a07bf6e0ed1"
                },
                {
                    "url": "https://git.kernel.org/stable/c/96189080265e6bb5dde3a4afbaf947af493e3f82"
                }
            ],
            "title": "io_uring: ensure ctx->rings is stable for task work flags manipulation",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}