All vulnerabilities
CVE-2026-97619

Linux: io_uring/rw: end write accounting from ->ki_complete

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in696459029f3b65c070c91b729478475582f1dcdfAlso 055d43a1233edbd80e558889258105ce63051bcd, 796aa0547557e63338657ed1c487906f9fac4c73 and 3 moreCVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

io_uring/rw: end write accounting from ->ki_complete

Commit b000145e9907 moved both the fsnotify calls and the write accounting out of the kiocb completion handler and into the io_req_rw_complete() task_work. However, only the fsnotify part actually needed to move as it may sleep. Ending the write accounting is just a percpu_up_read() on the superblock writers sem.

Deferring it is a problem, because it makes dropping SB_FREEZE_WRITE protection depend on the ring owner getting to running task_work. But the task may be blocked in freeze_super(), causing it to never get to that:

task io-wq worker -------------------------------------------------------------- io_write() io_kiocb_start_write() (takes sb_writers, hidden from lockdep by __sb_writers_release) write_iter() -> -EIOCBQUEUED ioctl(FS_IOC_SHUTDOWN) bdev_freeze() freeze_super() percpu_down_write() <- waits for the reader above io_write() kiocb_start_write() percpu_down_read() <- queued behind the writer <bio completes> io_complete_rw() queues io_req_rw_complete() <- never runs, task is in D state

End the write from io_complete_rw() instead, and leave only the fsnotify calls in task_work.

Text from CVE List

Affected versions 18

  • Linuxaffected: b000145e9907809406d8164c3b2b8861d95aecd1 before ed1cead97afb9c398bd7ab344a3c1ee34ab73af9CVE List
  • Linuxaffected: b000145e9907809406d8164c3b2b8861d95aecd1 before 696459029f3b65c070c91b729478475582f1dcdfCVE List
  • Linuxaffected: b000145e9907809406d8164c3b2b8861d95aecd1 before cc580cee4dfa2ec9099c30ecbd4d804cbb996432CVE List
  • Linuxaffected: b000145e9907809406d8164c3b2b8861d95aecd1 before 055d43a1233edbd80e558889258105ce63051bcdCVE List
  • Linuxaffected: b000145e9907809406d8164c3b2b8861d95aecd1 before 796aa0547557e63338657ed1c487906f9fac4c73CVE List
  • Linuxaffected: ea2e6286e3e89a115ae554e20ba9aec2b2e1ddffCVE List
  • Linuxaffected: 89a410dbd0f159ddd308f19d6eb682fc753e4771CVE List
  • Linuxaffected: 2a853c206e553dd9c0a55c22858fd6a446d93e15CVE List
  • Linuxaffected: 5.10.165 before 5.11CVE List
  • Linuxaffected: 5.15.90 before 5.16CVE List
  • Linuxaffected: 6.0.3 before 6.1CVE List
  • Linuxaffected: 6.1CVE List
  • Linuxunaffected: all versions before 6.1CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5