VulnerabilityPublished 9 Sep 2026Updated 21 Oct 2026

CVE-2026-80920: Linux kernel · io_uring: defer eventfd signaling when queued from a wakeup handler

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in e22f4494cc9487d326e5e3067f33dea7c1e442b2 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 13:47 UTC

Severity

Unrated

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in e22f4494cc9487d326e5e3067f33dea7c1e442b2, d0c240f25e654442a72af5ca021a02165ccce638, cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e +3

Exploitation evidence

Disclosed: evidence found.
CVE published 9 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 21a091b970cdbcf3e8ff829234b51be6f9192766, < e22f4494cc9487d326e5e3067f33dea7c1e442b2	Fixed in e22f4494cc9487d326e5e3067f33dea7c1e442b2
LinuxLinux	Affected ≥ 21a091b970cdbcf3e8ff829234b51be6f9192766, < d0c240f25e654442a72af5ca021a02165ccce638	Fixed in d0c240f25e654442a72af5ca021a02165ccce638
LinuxLinux	Affected ≥ 21a091b970cdbcf3e8ff829234b51be6f9192766, < cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e	Fixed in cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e
LinuxLinux	Affected ≥ 21a091b970cdbcf3e8ff829234b51be6f9192766, < b6bb334b0e9348887e3e55e1f494b0c3b8fbf59f	Fixed in b6bb334b0e9348887e3e55e1f494b0c3b8fbf59f
LinuxLinux	Affected ≥ 21a091b970cdbcf3e8ff829234b51be6f9192766, < 40b6ccf68731809ceb85c6e9f0f8f2ed61c7aa5a	Fixed in 40b6ccf68731809ceb85c6e9f0f8f2ed61c7aa5a
LinuxLinux	Affected ≥ 21a091b970cdbcf3e8ff829234b51be6f9192766, < 9d984451baf768ecd9e1fdad4637b729fcb2c9d5	Fixed in 9d984451baf768ecd9e1fdad4637b729fcb2c9d5

Description

In the Linux kernel, the following vulnerability has been resolved: io_uring: defer eventfd signaling when queued from a wakeup handler io_req_local_work_add() signals the CQ ring eventfd inline when it is the one to push the first entry onto ->work_list. For DEFER_TASKRUN rings that add is frequently done from a waitqueue wakeup handler, where an arbitrary waitqueue lock is held. eventfd_signal_mask() only refuses to recurse when current->in_eventfd is set, but that bit is set by eventfd_signal_mask() itself. If the wake chain starts somewhere else, signal goes out inline and can feed back into epoll. Add IOU_F_TWQ_IN_WAKE, set it on the task_work add done from the three waitqueue callbacks, and use it to force io_eventfd_signal() down the existing call_rcu_hurry() deferral instead of signaling inline.

References

Community reviews

Loading reviews…