CVE-2026-98858

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

io_uring: fix task_work add use-after-free with SQPOLL

For SQPOLL, the sqpoll thread runs task_work off its own list and

doesn't need to be told about it, so it can pop and complete a request

as soon as mpscq_push() has published it. If that was the last request

holding the ring alive, io_ring_exit_work() then frees the ctx, stops

the thread, and with it the tctx, while io_req_normal_work_add() is

still looking at both after the push:

BUG: KASAN: slab-use-after-free in io_req_normal_work_add+0x439/0x510

Read of size 4 at addr ff11000000ca0000 by task repro/55

(...)

BUG: KASAN: slab-use-after-free in queue_work_on+0x25/0x70

Write of size 8 at addr ff11000000c3bd00 by task repro/55

Hold an RCU read lock across the add, like io_req_local_work_add() already

does, and have io_ring_exit_work() wait for a grace period for SQPOLL rings

as well before freeing the ctx.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References