CVE-2026-46274 - Vulnerability Details

- io-wq: check that the predecessor is hashed in io_wq_remove_pending()

Description

In the Linux kernel, the following vulnerability has been resolved:

io-wq: check that the predecessor is hashed in io_wq_remove_pending()

io_wq_remove_pending() needs to fix up wq->hash_tail[] if the cancelled
work was the tail of its hash bucket. When doing this, it checks whether
the preceding entry in acct->work_list has the same hash value, but
never checks that the predecessor is hashed at all. io_get_work_hash()
is simply atomic_read(&work->flags) >> IO_WQ_HASH_SHIFT, and the hash
bits are never set for non-hashed work, so it returns 0. Thus, when a
hashed bucket-0 work is cancelled while a non-hashed work is its list
predecessor, the check spuriously passes and a pointer to the non-hashed
io_kiocb is stored in wq->hash_tail[0].

Because non-hashed work is dequeued via the fast path in
io_get_next_work(), which never touches hash_tail[], the stale pointer
is never cleared. Therefore, after the non-hashed io_kiocb completes and
is freed back to req_cachep, wq->hash_tail[0] is a dangling pointer. The
io_wq is per-task (tctx->io_wq) and survives ring open/close, so the
dangling pointer persists for the lifetime of the task; the next hashed
bucket-0 enqueue dereferences it in io_wq_insert_work() and
wq_list_add_after() writes through freed memory.

Add the missing io_wq_is_hashed() check so a non-hashed predecessor
never inherits a hash_tail[] slot.

Published: 2026-06-08

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw resides in the Linux kernel's io_wq_remove_pending() routine, where the code fails to verify that a predecessor work item is hashed before reusing hash_tail pointers. When a hashed work entry is cancelled while an un-hashed predecessor is present, a stale pointer to freed memory is stored in wq->hash_tail[0]. Because the fast path for non‑hashed work never clears this pointer, it becomes a dangling reference that may later be dereferenced by io_wq_insert_work, leading to kernel memory corruption (a Use‑After‑Free, CWE‑825).

Affected Systems

The defect is present in all Linux kernel releases prior to the commit that introduced the fix. The CVE data does not specify exact kernel version numbers, so the scope includes any installation that has not yet applied the patch commit or a later stable kernel that incorporates it.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV. No public exploits have been documented, but a local attacker who can manipulate IO operations could trigger the use‑after‑free and cause a crash or potentially elevate privileges by corrupting kernel memory.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`204361a77f4018627addd4a06877448f088ddfc0`	affected	< d6bda9df0c0a3080804181464d5c0f4d78a4e769
`204361a77f4018627addd4a06877448f088ddfc0`	affected	< 5a20ebf0c81b61f5ea3b1b529c100cad69b9f603
`204361a77f4018627addd4a06877448f088ddfc0`	affected	< 252c5051dba9c709b6a72f2866f93e5e618b3f06
`204361a77f4018627addd4a06877448f088ddfc0`	affected	< d376c131af7c7739a87ff037ed2fdb67c2542c8a
`204361a77f4018627addd4a06877448f088ddfc0`	affected	< d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc
`13f35a2c0fd5c6a4fcd8903542b053bcc914fcf5`	affected	—
`5.8.6`	affected	< 5.9

Linux

affected

Version	Status	Constraints
`5.9`	affected	—
`0`	unaffected	< 5.9
`6.6.141`	unaffected	≤ 6.6.*
`6.12.91`	unaffected	≤ 6.12.*
`6.18.33`	unaffected	≤ 6.18.*
`7.0.10`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[204361a77f4018627addd4a06877448f088ddfc0,d6bda9df0c0a3080804181464d5c0f4d78a4e769)`	affected	code_commit	—
`[204361a77f4018627addd4a06877448f088ddfc0,5a20ebf0c81b61f5ea3b1b529c100cad69b9f603)`	affected	code_commit	—
`[204361a77f4018627addd4a06877448f088ddfc0,252c5051dba9c709b6a72f2866f93e5e618b3f06)`	affected	code_commit	—
`[204361a77f4018627addd4a06877448f088ddfc0,d376c131af7c7739a87ff037ed2fdb67c2542c8a)`	affected	code_commit	—
`[204361a77f4018627addd4a06877448f088ddfc0,d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc)`	affected	code_commit	—
`13f35a2c0fd5c6a4fcd8903542b053bcc914fcf5`	affected	code_commit	—
`[5.8.6,5.9)`	affected	generic	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.9`	affected	generic	—
`[0,5.9)`	unaffected	generic	—
`[6.6.141,6.7.0)`	unaffected	semver	—
`[6.12.91,6.13.0)`	unaffected	semver	—
`[6.18.33,6.19.0)`	unaffected	semver	—
`[7.0.10,7.1.0)`	unaffected	semver	—
`[7.1-rc4,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel update that includes the patch commit 252c5051 or any newer stable release containing the fix.
Reboot the system to load the patched kernel and discard any lingering dangling pointers.
If updating the kernel is not immediately possible, restrict or disable the use of IO work queue functionality in applications, or apply system controls to limit scheduled IO operations that could trigger the fault.

Generated by OpenCVE AI on June 9, 2026 at 02:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6355-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00138.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/252c5051dba9c709b6a72f2866f93e5e618b3f06
https://git.kernel.org/stable/c/5a20ebf0c81b61f5ea3b1b529c100cad69b9f603
https://git.kernel.org/stable/c/d376c131af7c7739a87ff037ed2fdb67c2542c8a
https://git.kernel.org/stable/c/d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc
https://git.kernel.org/stable/c/d6bda9df0c0a3080804181464d5c0f4d78a4e769
https://lore.kernel.org/linux-cve-announce/2026060803-CVE-2026-46274-b5c3@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-46274
https://www.cve.org/CVERecord?id=CVE-2026-46274

History

Tue, 09 Jun 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026060803-CVE-2026-46274-b5c3@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-46274 https://www.cve.org/CVERecord?id=CVE-2026-46274
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Mon, 08 Jun 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: io-wq: check that the predecessor is hashed in io_wq_remove_pending() io_wq_remove_pending() needs to fix up wq->hash_tail[] if the cancelled work was the tail of its hash bucket. When doing this, it checks whether the preceding entry in acct->work_list has the same hash value, but never checks that the predecessor is hashed at all. io_get_work_hash() is simply atomic_read(&work->flags) >> IO_WQ_HASH_SHIFT, and the hash bits are never set for non-hashed work, so it returns 0. Thus, when a hashed bucket-0 work is cancelled while a non-hashed work is its list predecessor, the check spuriously passes and a pointer to the non-hashed io_kiocb is stored in wq->hash_tail[0]. Because non-hashed work is dequeued via the fast path in io_get_next_work(), which never touches hash_tail[], the stale pointer is never cleared. Therefore, after the non-hashed io_kiocb completes and is freed back to req_cachep, wq->hash_tail[0] is a dangling pointer. The io_wq is per-task (tctx->io_wq) and survives ring open/close, so the dangling pointer persists for the lifetime of the task; the next hashed bucket-0 enqueue dereferences it in io_wq_insert_work() and wq_list_add_after() writes through freed memory. Add the missing io_wq_is_hashed() check so a non-hashed predecessor never inherits a hash_tail[] slot.
Title		io-wq: check that the predecessor is hashed in io_wq_remove_pending()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/252c5051dba9c709b6a72f2866f93e5e618b3f06 https://git.kernel.org/stable/c/5a20ebf0c81b61f5ea3b1b529c100cad69b9f603 https://git.kernel.org/stable/c/d376c131af7c7739a87ff037ed2fdb67c2542c8a https://git.kernel.org/stable/c/d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc https://git.kernel.org/stable/c/d6bda9df0c0a3080804181464d5c0f4d78a4e769

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-08T14:30:53.323Z

Updated: 2026-06-14T18:05:34.336Z

Reserved: 2026-05-13T15:03:33.109Z

Link: CVE-2026-46274

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-06-08T16:16:40.707

Modified: 2026-06-14T06:16:22.063

Link: CVE-2026-46274

Redhat

Severity : Moderate

Publid Date: 2026-06-08T00:00:00Z

Links: CVE-2026-46274 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-09T02:30:26Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object