https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 07:08:11 +0000 https://vulnerability.circl.lu/vuln/cve-2026-81010 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>io_uring/waitid: honor task_work cancellation</p> <p>io_waitid_cb() may run through the fallback task_work path when task_work_add() can no longer queue work to the originating task. The fallback runs from a kworker and io_uring marks such task work as canceled through tw.cancel.</p> <p>io_waitid_cb() currently ignores tw.cancel and calls __do_wait(). waitid is task-context dependent: __do_wait() performs child lookup relative to current, and the retry path also uses current-&gt;signal-&gt;wait_chldexit. If the callback runs from the fallback kworker, current is therefore not the task that submitted the request.</p> <p>Honor tw.cancel before entering __do_wait(). Complete the request with -ECANCELED and skip the siginfo copy, since canceled task work may run without the submitting task&#39;s userspace execution context.</p> <p>Keep the existing siginfo handling for normal waitid completion and explicit cancellation.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>io_uring/waitid: honor task_work cancellation</p> <p>io_waitid_cb() may run through the fallback task_work path when task_work_add() can no longer queue work to the originating task. The fallback runs from a kworker and io_uring marks such task work as canceled through tw.cancel.</p> <p>io_waitid_cb() currently ignores tw.cancel and calls __do_wait(). waitid is task-context dependent: __do_wait() performs child lookup relative to current, and the retry path also uses current-&gt;signal-&gt;wait_chldexit. If the callback runs from the fallback kworker, current is therefore not the task that submitted the request.</p> <p>Honor tw.cancel before entering __do_wait(). Complete the request with -ECANCELED and skip the siginfo copy, since canceled task work may run without the submitting task&#39;s userspace execution context.</p> <p>Keep the existing siginfo handling for normal waitid completion and explicit cancellation.</p> https://vulnerability.circl.lu/vuln/cve-2026-81010