EUVD-2026-18746
GHSA-c5mp-x9x5-3g5v
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
io_uring/poll: fix multishot recv missing EOF on wakeup race
When a socket send and shutdown() happen back-to-back, both fire wake-ups before the receiver's task_work has a chance to run. The first wake gets poll ownership (poll_refs=1), and the second bumps it to 2. When io_poll_check_events() runs, it calls io_poll_issue() which does a recv that reads the data and returns IOU_RETRY. The loop then drains all accumulated refs (atomic_sub_return(2) -> 0) and exits, even though only the first event was consumed. Since the shutdown is a persistent state change, no further wakeups will happen, and the multishot recv can hang forever.
Check specifically for HUP in the poll loop, and ensure that another loop is done to check for status if more than a single poll activation is pending. This ensures we don't lose the shutdown event.
AnalysisAI
Linux kernel io_uring/poll multishot recv can hang indefinitely when a socket shutdown occurs concurrently with data reception, due to a race condition where accumulated poll wakeups are drained without consuming the persistent HUP event. The vulnerability affects all Linux kernel versions with io_uring poll support and requires a fix to explicitly check for HUP conditions and re-loop when multiple poll activations are pending.
Technical ContextAI
This vulnerability exists in the io_uring subsystem's poll implementation, specifically in the multishot recv operation pathway. The io_uring interface provides asynchronous I/O operations via the poll_refs reference-counting mechanism, which tracks pending wakeup events. The race condition occurs in io_poll_check_events() when io_poll_issue() performs a recv operation that returns IOU_RETRY after reading available data, then atomically decrements accumulated poll_refs to zero and exits the polling loop. Since socket shutdown() is a persistent state change (not a transient event), it does not generate additional wakeups after the initial ones are consumed. The underlying issue is a missing explicit check for the HUP (hang-up/EOF) condition in the poll event loop, allowing the receiver to miss the shutdown notification entirely. This is a logic flaw (CWE class: race condition in concurrent code) in event handling rather than memory safety or authentication bypass.
RemediationAI
Apply the upstream Linux kernel fix by upgrading to a patched kernel version that includes commit 0f4ce79b8db7b040373fc664c8bc6c5fd74bd196 or its backported equivalent in your distribution. For RHEL/CentOS, check kernel-update advisories; for Ubuntu/Debian, apply latest linux-image package updates from your LTS branch. The fix involves modifying io_poll_check_events() to explicitly check for the HUP poll condition (via poll_event_mask & EPOLLHUP) and ensuring the polling loop re-executes if multiple poll activations (poll_refs > 1) are pending after a single event consumption. If immediate patching is not feasible, mitigate by reducing reliance on multishot recv with io_uring in production workloads, or use synchronous socket operations with epoll/select for critical shutdown-sensitive code paths. References: https://git.kernel.org/stable/c/0f4ce79b8db7b040373fc664c8bc6c5fd74bd196
More in Linux Kernel
View allLinux kernel contains a flaw known as 'Dirty Pipe' where improper pipe buffer flag initialization allows unprivileged lo
The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does no
The packet_set_ring function in net/packet/af_packet.c in the Linux kernel through 4.10.6 does not properly validate cer
The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial
Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. Rated high severity (CVSS 7.0). Public ex
The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr op
The mem_write function in the Linux kernel before 3.2.2, when ASLR is disabled, does not properly check permissions when
The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allo
Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cau
The join_session_keyring function in security/keys/process_keys.c in the Linux kernel before 4.4.1 mishandles object ref
A remote code execution vulnerability in the Broadcom Wi-Fi firmware could enable a remote attacker to execute arbitrary
It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the h
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today