CVE-2026-81010

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The bug is reached by submitting IORING_OP_WAITID via io_uring_setup/io_uring_enter, then forcing canceled task_work by closing the ring or exiting the submitting task. Per kernel scoring guidance, io_uring bugs are Local.

AC:LAttack complexity, low

The attacker controls the full sequence: create a DEFER_TASKRUN ring, submit WAITID, fork/signal children so io_waitid_wait queues io_waitid_cb, then close the ring so io_ring_exit_work runs that callback from a kworker with tw.cancel set. No uninfluenced race or rare config is required.

PR:LPrivileges required, low

Unprivileged users can create an io_uring ring (sysctl_io_uring_disabled defaults to 0) and IORING_OP_WAITID has no capability check; waiting on one's own children needs no privilege. User namespaces or init-namespace root are not required.

UI:NUser interaction, none

The attacker performs every step in their own process (ring setup, WAITID submission, child fork/signal, and ring close or exit). No other user must act.

S:UScope, unchanged

Wrong-context waitid completion and the resulting kernel memory corruption stay within the host kernel's security authority. This is standard local privilege-escalation/DoS impact, not a VM, IOMMU, or sandbox boundary crossing.

C:HConfidentiality impact, high

Ignoring tw.cancel lets io_waitid_cb run __do_wait and unsafe_put_user of siginfo from a PF_KTHREAD fallback worker whose lazy-TLB CR3 may be another mm, including one concurrently torn down by exit_mmap, yielding memory corruption over reused pages/page tables that can be leveraged for kernel disclosure.

I:HIntegrity impact, high

The same kworker path writes siginfo fields through unsafe_put_user to an attacker-chosen userspace address without the submitter's mm, and the -ERESTARTSYS retry can add a wait-queue entry on the kworker's wait_chldexit. Wrong-mm writes and wait-queue corruption are High-integrity primitives.

A:HAvailability impact, high

Userspace access against a missing or tearing-down mm, and wait-queue manipulation on the wrong task, produce kernel faults, oopses, and panics; the unexploited fallback path can also crash or hang ring-teardown. Any kernel crash is High availability.