CVE-2026-80920: Linux Kernel Race Condition Vulnerability

CVE-2026-80920 Overview

CVE-2026-80920 is a Linux kernel vulnerability in the io_uring subsystem. The flaw resides in io_req_local_work_add(), which signals the completion queue (CQ) ring eventfd inline when it pushes the first entry onto ->work_list. For rings configured with DEFER_TASKRUN, this add is frequently invoked from a waitqueue wakeup handler while an arbitrary waitqueue lock is held. The inline eventfd signal can recurse back into epoll, creating unsafe re-entry into locking contexts that were not designed to accommodate it.

Critical Impact
An eventfd signal issued while holding a waitqueue lock can feed back into epoll and trigger unsafe recursion within the kernel scheduler and I/O paths.

Affected Products

Linux kernel io_uring subsystem
Kernel builds supporting DEFER_TASKRUN rings with eventfd registration
Distributions shipping affected mainline and stable kernel branches

Discovery Timeline

2026-09-09 - CVE CVE-2026-80920 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-80920

Vulnerability Analysis

The io_uring fast completion path calls io_req_local_work_add() to enqueue work when a request completes. When the caller is the first to push onto ->work_list, the function signals the registered CQ ring eventfd inline. This behavior is safe in most contexts, but DEFER_TASKRUN rings are commonly driven from waitqueue wakeup handlers where an arbitrary waitqueue lock is already held.

Inside eventfd_signal_mask(), the only guard against recursion is the current->in_eventfd flag, which is set by eventfd_signal_mask() itself. If the wake chain originates outside of eventfd, that flag is not set, so the signal proceeds inline. The signal can then feed back into epoll and re-enter waitqueue paths while a lock is still held.

Root Cause

The root cause is missing context awareness in the task_work add path. io_req_local_work_add() cannot distinguish adds that originate from a waitqueue wakeup handler, so it emits the eventfd signal without deferral. The current->in_eventfd heuristic only prevents recursion when the chain begins inside eventfd itself.

Attack Vector

Exploitation requires a local process that opens an io_uring instance with DEFER_TASKRUN, registers an eventfd, and structures workloads so completions are triggered from waitqueue wakeup handlers. Under those conditions the kernel takes an unsafe re-entrant path that can produce locking anomalies. The upstream fix introduces the IOU_F_TWQ_IN_WAKE flag, sets it in the three waitqueue callbacks that add task_work, and uses it in io_eventfd_signal() to force the existing call_rcu_hurry() deferral instead of signaling inline. See the kernel commit b6bb334 for the resolved logic.

Detection Methods for CVE-2026-80920

Indicators of Compromise

Kernel logs referencing io_uring, eventfd, or lockdep splats involving waitqueue re-entry
Unexpected WARN_ON or BUG reports along the io_req_local_work_add call path
Processes making heavy use of io_uring with DEFER_TASKRUN and a registered eventfd

Detection Strategies

Inventory running kernel versions and compare against fixed stable branches referenced in the kernel.org commits
Audit userspace workloads that call io_uring_register_eventfd() on DEFER_TASKRUN rings
Enable CONFIG_PROVE_LOCKING in test environments to surface unsafe re-entry along io_uring paths

Monitoring Recommendations

Forward dmesg and journald kernel events to a central logging platform and alert on lockdep warnings
Track process-level io_uring_setup and eventfd registration calls through eBPF or auditd
Correlate kernel crash telemetry with recent workload changes on hosts running unpatched kernels

How to Mitigate CVE-2026-80920

Immediate Actions Required

Identify hosts running kernels that predate the fix commits and prioritize them for patching
Update to a stable kernel release that includes the IOU_F_TWQ_IN_WAKE deferral fix
Restrict local access on multi-tenant systems where untrusted users can invoke io_uring

Patch Information

The fix is available in the upstream Linux kernel through commits 40b6ccf, b6bb334, cd305ee, and e22f449. The patches add the IOU_F_TWQ_IN_WAKE flag and route eventfd signaling through the existing call_rcu_hurry() deferral when task_work is added from a waitqueue callback. Apply the corresponding stable update from your distribution vendor.

Workarounds

Disable eventfd registration on io_uring rings where the workload permits
Reconfigure applications to avoid DEFER_TASKRUN until the kernel patch is applied
Use kernel command-line or seccomp policies to limit io_uring availability to trusted workloads

bash

# Verify current kernel version and check for io_uring / eventfd usage
uname -r
sysctl kernel.io_uring_disabled 2>/dev/null
grep -R io_uring /proc/*/comm 2>/dev/null | head