VulnerabilityPublished 3 Nov 2026Updated 4 Nov 2026

CVE-2026-99254: Linux kernel · io_uring: don't flood a cancelling task with task_work

Affects Linux kernelSource GCVE Database

Compare

Authoritative record:CVE-2026-99254· Medium

Not known to be exploited.

Data as of 4 Nov 2026, 23:29 UTC

Severity

Medium

Rated by Threat Radar · CVSS not yet scored by NVD

Thin evidence

One scorer or none

EPSS: 0.1% chance of exploitation in 30 days – higher than 9% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 3 Nov 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 4 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Ubuntu 26.10linux`pkg:deb/ubuntu/linux?arch=source&distro=stonking`Other threats	Affected 7.0.0-14.14 – 7.3.0-10.10 7 affected builds	Fixed in–
Ubuntu 26.10linux-aws`pkg:deb/ubuntu/linux-aws?arch=source&distro=stonking`Other threats	Affected 7.0.0-1004.4 – 7.3.0-1004.4 6 affected builds	Fixed in–
Ubuntu 26.10linux-azure`pkg:deb/ubuntu/linux-azure?arch=source&distro=stonking`Other threats	Affected 7.0.0-1004.4 – 7.3.0-1004.4 6 affected builds	Fixed in–
Ubuntu 26.10linux-azure-fde`pkg:deb/ubuntu/linux-azure-fde?arch=source&distro=stonking`Other threats	Affected 7.0.0-1004.4 – 7.3.0-1004.5 4 affected builds	Fixed in–
Ubuntu 26.10linux-gcp`pkg:deb/ubuntu/linux-gcp?arch=source&distro=stonking`Other threats	Affected 7.0.0-1003.3 – 7.3.0-1004.4 6 affected builds	Fixed in–
Ubuntu 26.10linux-oracle`pkg:deb/ubuntu/linux-oracle?arch=source&distro=stonking`Other threats	Affected 7.0.0-1003.3 – 7.3.0-1004.4 6 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A fix for this vulnerability has been implemented in the Linux kernel. Users should update to a patched kernel version to resolve the issue.

Description

CVE-2026-99254 is a vulnerability in the Linux kernel's io_uring subsystem where a cancelling task can be flooded with repeated task_work callbacks. This occurs because the io_ring_exit_work() function repeatedly queues callbacks for tasks that have used the ring until a list is empty, but the cancellation process does not remove nodes promptly, causing excessive callbacks. This can cause a task to consume CPU resources excessively and become stuck for minutes, impacting system responsiveness. No privilege is required to trigger this behavior.

Impact

The vulnerability can cause a task in the Linux kernel using io_uring to become stuck in a loop of callbacks, consuming CPU resources excessively and delaying task exit or cancellation. This can degrade system performance and responsiveness, potentially for minutes. The issue affects tasks during exit_group() or execve() cancellation processes. There is no privilege requirement, so any user can trigger this condition.

Summary

The vulnerability in Linux kernel io_uring involves the io_ring_exit_work() function repeatedly invoking task_work callbacks for a cancelling task due to improper handling of task context nodes during cancellation. Specifically, io_tctx_exit_cb() does not modify nodes while the task is in io_uring_cancel_generic(), which removes nodes only at its end. This leads to repeated queuing of the callback, causing a task to run thousands of callbacks over several seconds, potentially keeping CPU and work items busy indefinitely until all senders are late simultaneously. This can cause an exiting or live task to become stuck for minutes, with no privilege required for exploitation.

GCVE source: db.gcve.eu
OSV ID: UBUNTU-CVE-2026-99254
Osv Schema Version: 1.7.0
Ecosystems: Ubuntu:16.04:LTS, Ubuntu:18.04:LTS, Ubuntu:20.04:LTS, Ubuntu:Pro:20.04:LTS, Ubuntu:22.04:LTS, Ubuntu:Nvidia-BlueField:22.04:LTS, Ubuntu:Pro:Realtime:22.04:LTS, Ubuntu:Pro:FIPS-preview:22.04:LTS, Ubuntu:Pro:FIPS-updates:22.04:LTS, Ubuntu:24.04:LTS, Ubuntu:Nvidia-BlueField:24.04:LTS, Ubuntu:Pro:Realtime:24.04:LTS, Ubuntu:Pro:FIPS-updates:24.04:LTS, Ubuntu:26.10, Ubuntu:26.04:LTS

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 4 Nov 2026, 21:17 UTC

Technical details

References

Community reviews

Related threats