CVE-2026-52946 addresses a deadlock vulnerability in the Linux kernel's fs/fcntl subsystem caused by an unsafe lock order between SOFTIRQ-safe and SOFTIRQ-unsafe contexts during fasync signaling. Specifically, send_sigio() and send_sigurg() functions, which are invoked in softirq context, acquire read_lock(&tasklist_lock) while a writer lock may be pending, leading to a deadlock scenario involving multiple CPUs. The root cause is the rwlock writer fairness mechanism blocking new readers when a writer is waiting. The vulnerability is mitigated by replacing the read_lock(&tasklist_lock) with rcu_read_lock(), leveraging existing RCU protections for safe traversal of process groups. This change also reduces the risk of a remote denial of service triggered by TCP URG packets.

The vulnerability can cause a deadlock in the Linux kernel, resulting in a denial of service condition. This can be triggered remotely via TCP URG packets, potentially impacting system availability. There is no impact on confidentiality or integrity. The CVSS v3.1 score is 7.5 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

A fix is available that replaces the read_lock(&tasklist_lock) with rcu_read_lock() in the affected code paths. Users should apply the official Linux kernel updates that include this fix. Since this is a kernel-level vulnerability, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; users should check the vendor or Linux kernel advisories for the specific patched versions and apply updates accordingly.