CVE-2026-64425: Linux Kernel Race Condition Vulnerability

CVE-2026-64425 Overview

CVE-2026-64425 is a race condition in the Linux kernel's io_uring/io-wq worker subsystem. The flaw sits in io_worker_handle_work(), which snapshots the IO_WQ_BIT_EXIT flag once before processing an entire dependent linked-work chain. If io_wq_exit_start() sets IO_WQ_BIT_EXIT after the first linked item begins, subsequent linked items reuse the stale do_kill = false value. Those items skip the IO_WQ_WORK_CANCEL path and continue running after ring teardown has started.

The issue extends an earlier fix (commit 10dc95939817) that only re-checked the exit bit in the outer run loop.

Critical Impact
Linked io-wq work items can continue executing after io_uring exit begins, delaying teardown and creating race windows during ring destruction on affected Linux kernels.

Affected Products

Linux kernel io_uring/io-wq worker subsystem
Kernel branches that inherited commit 10dc95939817 ("io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop")
Stable kernel trees receiving the backported fix commits listed in the kernel.org references

Discovery Timeline

2026-07-25 - CVE-2026-64425 published to the National Vulnerability Database
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64425

Vulnerability Analysis

The io_uring subsystem uses io-wq worker threads to execute deferred and blocking work items. Work items can form linked chains where each item depends on completion of the previous one. When userspace closes an io_uring instance, io_wq_exit_start() sets IO_WQ_BIT_EXIT to signal workers to cancel outstanding work rather than execute it.

The prior fix ensured io_worker_handle_work() re-read the exit bit in its outer loop. However, the inner loop that walks a linked chain still relied on a single snapshot captured before the chain began. Linked items that started after exit was signaled therefore ran with do_kill = false and bypassed the IO_WQ_WORK_CANCEL short-circuit.

Root Cause

The defect is a stale-flag read across a race window. The variable derived from IO_WQ_BIT_EXIT is captured once per work item, not once per linked sub-item. This creates a time-of-check to time-of-use gap between the exit signal and the decision to cancel work within a dependent chain.

Attack Vector

Exploitation requires local access to submit io_uring operations. A syzbot reproducer chains many slow linked work items against devices whose reads take a long time to complete, for example the msr character device. The attacker then closes the ring immediately. Because the exit path must wait for the linked chain to drain, io_uring teardown stalls and worker threads execute work after exit has begun. See the kernel commit series for the exact code paths modified by the fix.

Detection Methods for CVE-2026-64425

Indicators of Compromise

Unexpectedly long io_uring ring teardown latency accompanied by lingering iou-wrk-* kernel worker threads after the owning process has closed its ring file descriptor.
Kernel log entries or syzkaller-style traces referencing io_worker_handle_work() executing linked work after io_wq_exit_start() has been invoked.
Unprivileged processes issuing high-volume io_uring submissions against slow character devices such as /dev/cpu/*/msr immediately followed by ring close.

Detection Strategies

Monitor for user processes that combine io_uring_setup with heavy linked-work submissions and rapid close() of the ring file descriptor.
Alert when kernel worker threads named iou-wrk-<pid> persist significantly longer than their parent process exit time.
Track kernel version and patch state across the Linux fleet to identify hosts running unpatched io-wq code.

Monitoring Recommendations

Enable audit rules for io_uring_setup, io_uring_enter, and io_uring_register syscalls where the workload profile does not require them.
Collect kernel warnings, soft lockups, and RCU stall traces referencing io_uring or io_wq symbols into a centralized log store for correlation.
Baseline normal io-wq worker lifetimes so anomalous long-lived workers surface during triage.

How to Mitigate CVE-2026-64425

Immediate Actions Required

Apply the upstream Linux kernel fix that moves the IO_WQ_BIT_EXIT re-check inside the linked-work loop in io_worker_handle_work().
Track your distribution vendor's advisory for the backported patch and schedule kernel updates on affected stable branches.
On systems that do not require io_uring, restrict its availability using the io_uring_disabled sysctl to reduce exposure.

Patch Information

The fix is available across multiple stable branches. See the upstream commits: 14b7eca, 1636d85, 29bef99, 6e2f51f, ab85765, b6f179a, d179533, and ea61b04.

Workarounds

Set kernel.io_uring_disabled=2 via sysctl to disable io_uring for all processes on hosts where the interface is not required.
Use seccomp filters or systemd SystemCallFilter=~@io_uring to block io_uring syscalls for untrusted workloads and containers.
Restrict access to slow character devices such as /dev/cpu/*/msr that can be abused to prolong linked-work chains.

bash

# Configuration example
# Disable io_uring system-wide until the kernel is patched
echo 'kernel.io_uring_disabled = 2' | sudo tee /etc/sysctl.d/99-disable-io_uring.conf
sudo sysctl --system

# Verify current state
sysctl kernel.io_uring_disabled

# Optional: block io_uring syscalls for a systemd service
# Add to the unit file under [Service]
#   SystemCallFilter=~@io_uring