CVE-2026-80920

What the bug is

io_req_local_work_add() signals the CQ ring eventfd inline when it is the one to push the first entry onto ->work_list. For DEFER_TASKRUN rings that add is frequently done from a waitqueue wakeup handler, where an arbitrary waitqueue lock is held. eventfd_signal_mask() only refuses to recurse when current->in_eventfd is set, but that bit is set by eventfd_signal_mask() itself. If the wake chain starts somewhere else, signal goes out inline and can feed back into epoll. Add IOU_F_TWQ_IN_WAKE, set it on the task_work add done from the three waitqueue callbacks, and use it to force io_eventfd_signal() down the existing call_rcu_hurry() deferral instead of signaling inline.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

include/linux/io_uring_types.h
io_uring/eventfd.c
io_uring/eventfd.h
io_uring/futex.c
io_uring/io_uring.c
io_uring/poll.c
io_uring/tw.c
io_uring/waitid.c

What this is

IO_URINGMAINTAINERS section matched on include/linux/io_uring_types.h · io-uring@vger.kernel.org · Maintained

Check it on the machine

grep -w CONFIG_IO_URING /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

Show whether Debian builds this, per release

Debian builds this code. Every release below compiles the affected file into the kernels it ships.

• bookworm, trixie, forky, sidy

y

built into the kernel image on every flavour - only a patch removes it

Build switch

CONFIG_IO_URING

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Signals

Published

2026-09-09 (39 days ago)source

CVSS

no vector published, unrated

Attack vector

not published

EPSS

0.16%, higher than 4.3% of all CVEssource

CISA KEV

not listedthe KEV catalogue

Debian urgency

not yet assignedsource

Subsystem

include/linux

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
6.1	6.18.49	e22f4494cc94
6.1	7.1.11	b6bb334b0e93
6.1	7.2.1	40b6ccf68731
6.1	7.3	cd305ee3633a