CVE-2026-81010: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-81010 Overview

CVE-2026-81010 is a Linux kernel vulnerability in the io_uring/waitid subsystem. The flaw resides in io_waitid_cb(), which ignores task_work cancellation signals when running through the fallback path. When task_work_add() cannot queue work to the originating task, the callback runs from a kworker instead. In that context, current no longer references the submitting task, yet __do_wait() still executes child lookups and accesses current->signal->wait_chldexit. This produces task-context confusion in a syscall interface that depends on task-relative state.

Critical Impact
A local attacker with the ability to submit io_uring waitid requests can trigger kernel-context confusion, leading to memory corruption, privilege escalation, or denial of service.

Affected Products

Linux kernel versions containing the io_uring waitid fallback task_work path
Distributions shipping vulnerable stable kernel branches prior to the fix commits
Systems where io_uring is enabled for unprivileged users

Discovery Timeline

2026-09-11 - CVE-2026-81010 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-81010

Vulnerability Analysis

The vulnerability lives in the io_uring asynchronous I/O framework, specifically in the waitid opcode handler. The waitid system call is inherently task-context dependent: it looks up children of the calling process and reads wait state from current->signal->wait_chldexit. In io_uring, waitid completion normally runs via task_work on the submitting task, preserving this context.

When task_work_add() fails, the kernel falls back to executing the callback from a kworker thread. io_uring marks such deferred work as canceled by setting tw.cancel. However, io_waitid_cb() proceeds to invoke __do_wait() regardless of the cancellation flag. Because current in a kworker points to the worker thread, the child lookup and signal state access reference the wrong task_struct.

The patched code honors tw.cancel before entering __do_wait(), completes the request with -ECANCELED, and skips the siginfo copy since canceled task work runs without the submitter's userspace execution context.

Root Cause

The root cause is a missing cancellation check [CWE-362] in the io_uring waitid callback path. The handler assumed task_work always executes in the originating task context, but the fallback kworker path violates that assumption. This is a race-adjacent kernel logic flaw where an operation that requires specific task context runs in an incorrect one.

Attack Vector

Exploitation requires local access with permission to invoke io_uring system calls. An attacker submits waitid operations and induces conditions that force task_work_add() to fail, such as task exit races. When the callback runs from the fallback kworker with tw.cancel set, __do_wait() dereferences the wrong task's signal and child lists, producing undefined kernel behavior. Refer to the upstream patch commits for the exact code path affected.

Detection Methods for CVE-2026-81010

Indicators of Compromise

Unexpected kernel oops or NULL pointer dereferences originating from io_waitid_cb or __do_wait in kworker context
Kernel log entries referencing io_uring waitid operations followed by task-related crashes
Anomalous -ECANCELED return patterns from io_uring waitid completions preceding stability issues

Detection Strategies

Audit io_uring_setup and io_uring_enter syscall usage from unprivileged processes
Monitor kernel ring buffer for stack traces involving io_waitid_cb, task_work_add, or fallback kworker execution
Correlate process exit events with concurrent io_uring waitid submissions from the same task

Monitoring Recommendations

Enable kernel auditing for io_uring subsystem calls on multi-tenant hosts
Deploy eBPF probes on io_waitid_cb entry to log invocations occurring outside the submitting task context
Aggregate kernel crash telemetry across the fleet to identify clustering around io_uring waitid faults

How to Mitigate CVE-2026-81010

Immediate Actions Required

Apply the upstream kernel patches referenced in commits 0879697520ab, 14572de82e50, and 7bc98e2de8c5
Update to the latest stable kernel provided by your distribution vendor
Restrict io_uring access for untrusted local users using available kernel controls

Patch Information

The fix modifies io_waitid_cb() to check the tw.cancel flag before entering __do_wait(). When cancellation is set, the request completes with -ECANCELED and the siginfo copy is skipped, since the fallback kworker lacks the submitter's userspace context. Normal waitid completion and explicit cancellation retain existing siginfo handling. See the kernel stable tree commits for the exact change.

Workarounds

Disable io_uring for unprivileged users by setting kernel.io_uring_disabled=2 where supported
Use seccomp filters to block io_uring_setup for containerized or sandboxed workloads
Apply SELinux or AppArmor policies restricting io_uring capabilities to trusted processes

bash

# Restrict io_uring access system-wide
sysctl -w kernel.io_uring_disabled=2
echo 'kernel.io_uring_disabled=2' >> /etc/sysctl.d/99-io-uring.conf

# Verify current setting
sysctl kernel.io_uring_disabled