Answer in brief
CVE-2026-23275 records a High severity (CVSS 7.8) vulnerability in io_uring: ensure ctx->rings is stable for task work flags manipulation. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=79cfe9e59c2a12c3b3faeeefe38d23f3d8030972 <7cc4530b3e952d4a5947e1e55d06620d8845d4f5 || >=79cfe9e59c2a12c3b3faeeefe38d23f3d8030972 <46dc07d5f31411cc023f3bf1f4a23a07bf6e0ed1 || >=79cfe9e59c2a12c3b3faeeefe38d23f3d8030972 <96189080265e6bb5dde3a4afbaf947af493e3f82 | 7cc4530b3e952d4a5947e1e55d06620d8845d4f5, 46dc07d5f31411cc023f3bf1f4a23a07bf6e0ed1, 96189080265e6bb5dde3a4afbaf947af493e3f82 |
| Linux/Linuxgeneric | 6.13 | Not reported |
Published upstream
Mar 20, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 16, 2026
In the Linux kernel, the following vulnerability has been resolved: io_uring: ensure ctx->rings is stable for task work flags manipulation If DEFER_TASKRUN | SETUP_TASKRUN is used and task work is added while the ring is being resized, it's possible for the OR'ing of IORING_SQ_TASKRUN to happen in the small window of swapping into the new rings and the old rings being freed. Prevent this by adding a 2nd ->rings pointer, ->rings_rcu, which is protected by RCU. The task work flags manipulation is inside RCU already, and if the resize ring freeing is done post an RCU synchronize, then there's no need to add locking to the fast path of task work additions. Note: this is only done for DEFER_TASKRUN, as that's the only setup mode that supports ring resizing. If this ever changes, then they too need to use the io_ctx_mark_taskrun() helper.
Quoted source text, attributed separately from HOL analysis.