In the Linux kernel, the following vulnerability has been resolved: io_uring: fix task_work add use-after-free with SQPOLL For SQPOLL, the sqpoll… (CVE-2026-98858)

The vulnerability in the Linux kernel's io_uring with SQPOLL mode arises from a use-after-free condition when the sqpoll thread processes task_work off its own list. Specifically, io_ring_exit_work() may free the context and stop the thread while io_req_normal_work_add() still accesses these structures, causing a use-after-free error detected by KASAN. The remediation involves holding an RCU read lock during the addition of task_work and having io_ring_exit_work() wait for an RCU grace period before freeing the context, aligning SQPOLL behavior with non-SQPOLL rings.

This use-after-free vulnerability could lead to kernel memory corruption, potentially causing system instability or crashes. There is no information about exploitation in the wild or direct impact on confidentiality, integrity, or availability beyond the memory corruption risk.

A fix has been implemented in the Linux kernel to address this use-after-free vulnerability by adding proper synchronization with RCU locks and grace periods. Users should update to the patched kernel version once available. No additional mitigation steps are indicated.