CVE-2026-52946 - Vulnerability Details

- fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling

Description

In the Linux kernel, the following vulnerability has been resolved:

fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling

A SOFTIRQ-safe to SOFTIRQ-unsafe lock order deadlock can occur in
send_sigio() and send_sigurg() when a process group receives a signal.

When FASYNC is configured for a process group (PIDTYPE_PGID), both
functions use read_lock(&tasklist_lock) to traverse the task list.
However, they are frequently called from softirq context:
- send_sigio() via input_inject_event -> kill_fasync
- send_sigurg() via tcp_check_urg -> sk_send_sigurg (NET_RX_SOFTIRQ)

The deadlock is caused by the rwlock writer fairness mechanism:
1. CPU 0 (process context) holds read_lock(&tasklist_lock) in do_wait().
2. CPU 1 (process context) attempts write_lock(&tasklist_lock) in
fork() or exit() and spins, which blocks all new readers.
3. CPU 0 is interrupted by a softirq (e.g., TCP URG packet reception).
4. The softirq calls send_sigurg() and attempts to acquire
read_lock(&tasklist_lock), deadlocking because CPU 1 is waiting.

Since PID hashing and do_each_pid_task() traversals are already
RCU-protected, the read_lock on tasklist_lock is no longer strictly
required for safe traversal. Fix this by replacing tasklist_lock with
rcu_read_lock(), aligning the process group signaling path with the
single-PID path. This also mitigates a potential remote denial of
service vector via TCP URG packets.

Lockdep splat:
=====================================================
WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected
[...]
Chain exists of:
&dev->event_lock --> &f_owner->lock --> tasklist_lock

Possible interrupt unsafe locking scenario:
CPU0 CPU1
---- ----
lock(tasklist_lock);
local_irq_disable();
lock(&dev->event_lock);
lock(&f_owner->lock);
<Interrupt>
lock(&dev->event_lock);

*** DEADLOCK ***

Published: 2026-06-24

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a SOFTIRQ‑unsafe lock order that can cause a deadlock between tasklist_lock and other locks when send_sigio or send_sigurg are invoked from softirq context. A process group with FASYNC enabled can be forced into a self‑inflicted deadlock when an urgent TCP packet or an input event triggers signal delivery. The resulting deadlock stalls kernel progress, effectively bringing the system to a halt and allowing an attacker to cause a denial of service.

Affected Systems

All Linux kernel builds that include the tasklist_lock read_lock in send_sigio or send_sigurg and do not yet apply the patch that replaces it with rcu_read_lock. The affected vendors are the Linux kernel maintainers; no specific distribution version is listed in the supplied data.

Risk and Exploitability

The CVSS score of 7.5 classifies the vulnerability as high severity, and the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The potential for exploitation remains, however, because an attacker with the ability to influence TCP URG packets or trigger input events can provoke the deadlock. The vulnerability is not listed in the CISA KEV catalog, but the denial‑of‑service impact of a kernel deadlock would affect all processes on the affected host.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 54626335ea4174ab2d9a183b511d825f6765e47b
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 897d6a7247739fb1528f98c575df4f2e5de7f994
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 32dbd5ce4be3a3ed7e00f8af18795cc84fc50a33
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< b5fa9e32fb6718f70c986ee14dd5d01b4846f331
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 1bee417678f1135e35b25a37734db46aa94258d2
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 20a93e397abe850c49b6fa0e8cc827b5f634a8f5
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< bfcc8e8d8a495bb34cae9e620adfb75fb13a3954
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 36c1b57b2ecf3c61ac93f5f07bd29b6f21e226ed
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 00633c4683828acd5256fa8d5163f440d74bbe71

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.259`	unaffected	≤ 5.10.*
`5.15.210`	unaffected	≤ 5.15.*
`6.1.176`	unaffected	≤ 6.1.*
`6.6.143`	unaffected	≤ 6.6.*
`6.12.94`	unaffected	≤ 6.12.*
`6.18.36`	unaffected	≤ 6.18.*
`7.0.13`	unaffected	≤ 7.0.*
`7.1.1`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,54626335ea4174ab2d9a183b511d825f6765e47b)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,897d6a7247739fb1528f98c575df4f2e5de7f994)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,32dbd5ce4be3a3ed7e00f8af18795cc84fc50a33)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,b5fa9e32fb6718f70c986ee14dd5d01b4846f331)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,1bee417678f1135e35b25a37734db46aa94258d2)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,20a93e397abe850c49b6fa0e8cc827b5f634a8f5)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,bfcc8e8d8a495bb34cae9e620adfb75fb13a3954)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,36c1b57b2ecf3c61ac93f5f07bd29b6f21e226ed)`	affected	code_commit	—
`[0,5.10.259)`	affected	semver	—
`[0,5.15.210)`	affected	semver	—
`[0,6.1.176)`	affected	semver	—
`[0,6.6.143)`	affected	semver	—
`[0,6.12.94)`	affected	semver	—
`[0,6.18.36)`	affected	semver	—
`[0,7.0.13)`	affected	semver	—
`[0,7.1.1)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5.10.259,5.11.0)`	unaffected	semver	—
`[5.15.210,5.16.0)`	unaffected	semver	—
`[6.1.176,6.2.0)`	unaffected	semver	—
`[6.6.143,6.7.0)`	unaffected	semver	—
`[6.12.94,6.13.0)`	unaffected	semver	—
`[6.18.36,6.19.0)`	unaffected	semver	—
`[7.0.13,7.1.0)`	unaffected	semver	—
`[7.1.1,7.2.0)`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update your latest release that incorporates the patch, e.g update && apt install --only-upgrade linux-image-* for Debian/Ubuntu or the equivalent for your platform.
Reboot the system so that the updated kernel loads.
If an automated update isn’t available, download the source tree, cherry‑pick the relevant commit (e.g., 1bee4176), rebuild the kernel, install the new image, and reboot.

Generated by OpenCVE AI on June 28, 2026 at 14:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4664-1	linux security update
Debian DLA	DLA-4665-1	linux security update
Debian DLA	DLA-4671-1	linux-6.1 security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00461.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/00633c4683828acd5256fa8d5163f440d74bbe71
https://git.kernel.org/stable/c/1bee417678f1135e35b25a37734db46aa94258d2
https://git.kernel.org/stable/c/20a93e397abe850c49b6fa0e8cc827b5f634a8f5
https://git.kernel.org/stable/c/32dbd5ce4be3a3ed7e00f8af18795cc84fc50a33
https://git.kernel.org/stable/c/36c1b57b2ecf3c61ac93f5f07bd29b6f21e226ed
https://git.kernel.org/stable/c/54626335ea4174ab2d9a183b511d825f6765e47b
https://git.kernel.org/stable/c/897d6a7247739fb1528f98c575df4f2e5de7f994
https://git.kernel.org/stable/c/b5fa9e32fb6718f70c986ee14dd5d01b4846f331
https://git.kernel.org/stable/c/bfcc8e8d8a495bb34cae9e620adfb75fb13a3954
https://lore.kernel.org/linux-cve-announce/2026062402-CVE-2026-52946-bf2a@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-52946
https://www.cve.org/CVERecord?id=CVE-2026-52946

History

Mon, 29 Jun 2026 05:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/00633c4683828acd5256fa8d5163f440d74bbe71

Sun, 28 Jun 2026 12:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-662 CWE-665

Sun, 28 Jun 2026 08:00:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Sat, 27 Jun 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-833
References		https://lore.kernel.org/linux-cve-announce/2026062402-CVE-2026-52946-bf2a@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-52946 https://www.cve.org/CVERecord?id=CVE-2026-52946
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Wed, 24 Jun 2026 19:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-662 CWE-665

Wed, 24 Jun 2026 17:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling A SOFTIRQ-safe to SOFTIRQ-unsafe lock order deadlock can occur in send_sigio() and send_sigurg() when a process group receives a signal. When FASYNC is configured for a process group (PIDTYPE_PGID), both functions use read_lock(&tasklist_lock) to traverse the task list. However, they are frequently called from softirq context: - send_sigio() via input_inject_event -> kill_fasync - send_sigurg() via tcp_check_urg -> sk_send_sigurg (NET_RX_SOFTIRQ) The deadlock is caused by the rwlock writer fairness mechanism: 1. CPU 0 (process context) holds read_lock(&tasklist_lock) in do_wait(). 2. CPU 1 (process context) attempts write_lock(&tasklist_lock) in fork() or exit() and spins, which blocks all new readers. 3. CPU 0 is interrupted by a softirq (e.g., TCP URG packet reception). 4. The softirq calls send_sigurg() and attempts to acquire read_lock(&tasklist_lock), deadlocking because CPU 1 is waiting. Since PID hashing and do_each_pid_task() traversals are already RCU-protected, the read_lock on tasklist_lock is no longer strictly required for safe traversal. Fix this by replacing tasklist_lock with rcu_read_lock(), aligning the process group signaling path with the single-PID path. This also mitigates a potential remote denial of service vector via TCP URG packets. Lockdep splat: ===================================================== WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected [...] Chain exists of: &dev->event_lock --> &f_owner->lock --> tasklist_lock Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(tasklist_lock); local_irq_disable(); lock(&dev->event_lock); lock(&f_owner->lock); <Interrupt> lock(&dev->event_lock); * DEADLOCK *
Title		fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1bee417678f1135e35b25a37734db46aa94258d2 https://git.kernel.org/stable/c/20a93e397abe850c49b6fa0e8cc827b5f634a8f5 https://git.kernel.org/stable/c/32dbd5ce4be3a3ed7e00f8af18795cc84fc50a33 https://git.kernel.org/stable/c/36c1b57b2ecf3c61ac93f5f07bd29b6f21e226ed https://git.kernel.org/stable/c/54626335ea4174ab2d9a183b511d825f6765e47b https://git.kernel.org/stable/c/897d6a7247739fb1528f98c575df4f2e5de7f994 https://git.kernel.org/stable/c/b5fa9e32fb6718f70c986ee14dd5d01b4846f331 https://git.kernel.org/stable/c/bfcc8e8d8a495bb34cae9e620adfb75fb13a3954

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-24T16:26:04.419Z

Updated: 2026-06-29T04:24:16.044Z

Reserved: 2026-06-09T07:44:35.371Z

Link: CVE-2026-52946

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-06-24T00:00:00Z

Links: CVE-2026-52946 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-28T15:00:12Z

Weaknesses

CWE-833
Deadlock

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object