{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-97619", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T16:01:01.159Z", "datePublished": "2026-09-25T10:22:25.644Z", "dateUpdated": "2026-10-21T12:53:30.123Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:53:30.123Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/rw: end write accounting from ->ki_complete\n\nCommit b000145e9907 moved both the fsnotify calls and the write\naccounting out of the kiocb completion handler and into the\nio_req_rw_complete() task_work. However, only the fsnotify part actually\nneeded to move as it may sleep. Ending the write accounting is just a\npercpu_up_read() on the superblock writers sem.\n\nDeferring it is a problem, because it makes dropping SB_FREEZE_WRITE\nprotection depend on the ring owner getting to running task_work. But\nthe task may be blocked in freeze_super(), causing it to never get to\nthat:\n\n task io-wq worker\n --------------------------------------------------------------\n io_write()\n io_kiocb_start_write() (takes sb_writers, hidden from\n lockdep by __sb_writers_release)\n write_iter() -> -EIOCBQUEUED\n ioctl(FS_IOC_SHUTDOWN)\n bdev_freeze()\n freeze_super()\n percpu_down_write() <- waits for the reader above\n io_write()\n kiocb_start_write()\n percpu_down_read() <- queued\n behind the\n writer\n \n io_complete_rw()\n queues io_req_rw_complete() <- never runs, task is in D state\n\nEnd the write from io_complete_rw() instead, and leave only the fsnotify\ncalls in task_work." } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "io_uring/rw.c" ], "versions": [ { "version": "b000145e9907809406d8164c3b2b8861d95aecd1", "lessThan": "ed1cead97afb9c398bd7ab344a3c1ee34ab73af9", "status": "affected", "versionType": "git" }, { "version": "b000145e9907809406d8164c3b2b8861d95aecd1", "lessThan": "696459029f3b65c070c91b729478475582f1dcdf", "status": "affected", "versionType": "git" }, { "version": "b000145e9907809406d8164c3b2b8861d95aecd1", "lessThan": "cc580cee4dfa2ec9099c30ecbd4d804cbb996432", "status": "affected", "versionType": "git" }, { "version": "b000145e9907809406d8164c3b2b8861d95aecd1", "lessThan": "055d43a1233edbd80e558889258105ce63051bcd", "status": "affected", "versionType": "git" }, { "version": "b000145e9907809406d8164c3b2b8861d95aecd1", "lessThan": "796aa0547557e63338657ed1c487906f9fac4c73", "status": "affected", "versionType": "git" }, { "version": "ea2e6286e3e89a115ae554e20ba9aec2b2e1ddff", "status": "affected", "versionType": "git" }, { "version": "89a410dbd0f159ddd308f19d6eb682fc753e4771", "status": "affected", "versionType": "git" }, { "version": "2a853c206e553dd9c0a55c22858fd6a446d93e15", "status": "affected", "versionType": "git" }, { "version": "5.10.165", "lessThan": "5.11", "status": "affected", "versionType": "semver" }, { "version": "5.15.90", "lessThan": "5.16", "status": "affected", "versionType": "semver" }, { "version": "6.0.3", "lessThan": "6.1", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "io_uring/rw.c" ], "versions": [ { "version": "6.1", "status": "affected" }, { "version": "0", "lessThan": "6.1", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.6.160" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.12.112" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.18.53" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "7.2.7" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "7.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.165" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.90" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0.3" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/ed1cead97afb9c398bd7ab344a3c1ee34ab73af9" }, { "url": "https://git.kernel.org/stable/c/696459029f3b65c070c91b729478475582f1dcdf" }, { "url": "https://git.kernel.org/stable/c/cc580cee4dfa2ec9099c30ecbd4d804cbb996432" }, { "url": "https://git.kernel.org/stable/c/055d43a1233edbd80e558889258105ce63051bcd" }, { "url": "https://git.kernel.org/stable/c/796aa0547557e63338657ed1c487906f9fac4c73" } ], "title": "io_uring/rw: end write accounting from ->ki_complete", "x_generator": { "engine": "bippy-1.2.0" } } } }