CVE-2026-97619

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

io_uring/rw: end write accounting from ->ki_complete

Commit b000145e9907 moved both the fsnotify calls and the write

accounting out of the kiocb completion handler and into the

io_req_rw_complete() task_work. However, only the fsnotify part actually

needed to move as it may sleep. Ending the write accounting is just a

percpu_up_read() on the superblock writers sem.

Deferring it is a problem, because it makes dropping SB_FREEZE_WRITE

protection depend on the ring owner getting to running task_work. But

the task may be blocked in freeze_super(), causing it to never get to

that:

task io-wq worker

--------------------------------------------------------------

io_write()

io_kiocb_start_write() (takes sb_writers, hidden from

lockdep by __sb_writers_release)

write_iter() -> -EIOCBQUEUED

ioctl(FS_IOC_SHUTDOWN)

bdev_freeze()

fr

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References