CVE-2026-23275 Linux CVE debrief

Who should care

Linux kernel maintainers, distribution security teams, and operators of systems or workloads that use io_uring with DEFER_TASKRUN/SETUP_TASKRUN. It is especially relevant for environments that rely on kernel updates and backported stable fixes.

Technical summary

The issue is in io_uring task-work flag handling during ring resize. The kernel resolves a race where IORING_SQ_TASKRUN may be OR'ed into ctx->rings while the context is transitioning to a new rings object and the old one is being freed. According to the supplied resolution text, the mitigation is to add ctx->rings_rcu as an RCU-protected pointer for task-work flag manipulation and to defer freeing the resized ring until after an RCU synchronize. The change is limited to DEFER_TASKRUN because that is the only setup mode that supports ring resizing in the described code path.

Defensive priority

High priority for kernel patching if you deploy affected Linux kernels and use io_uring in DEFER_TASKRUN mode. The issue is concurrency-sensitive and can affect kernel stability or correctness, so backporting the stable fix should be treated as a timely maintenance item.

Recommended defensive actions

• Check whether your Linux kernel build includes the stable fixes referenced by the official kernel commit links.
• Prioritize applying vendor or distribution backports for the io_uring ring-resize race fix.
• If you rely on io_uring with DEFER_TASKRUN, validate that patched kernels are present across all production hosts.
• Track distribution security advisories for kernel updates that include the io_uring RCU stabilization change.
• If you maintain a kernel-based appliance or custom kernel tree, review whether the io_uring task-work path includes the rings_rcu and RCU synchronize changes.

Evidence notes

The supplied CVE description states that the race occurs when DEFER_TASKRUN | SETUP_TASKRUN is used and task work is added while the ring is being resized. It also states the fix: add a second ctx->rings pointer (rings_rcu) protected by RCU and free the old ring only after an RCU synchronize. The NVD record is marked 'Undergoing Analysis' in the supplied source, so affected-version scope is not expanded beyond the kernel-specific text provided. Official reference links are kernel.org stable commit URLs; no additional exploit details or impact assertions are introduced here.

Official resources