The Linux kernel’s io_uring work‑queue logic incorrectly takes a snapshot of the IO_WQ_BIT_EXIT flag only once before draining a chain of linked work items. When the exit flag is set after the first item has started, subsequent items in the chain continue to use a stale snapshot, ignoring the exit request. This stale state usage, combined with a race condition between the exit flag and the work queue processing, lets linked work items run to completion even after the kernel has begun exiting, potentially consuming resources or stalling the system. The flaw reflects a failure to properly recheck a flag within a loop, a weakness captured by CWE‑1050.

All Linux kernel versions prior to the inclusion of commit 10dc95939817 are affected. Any active distribution that has not yet integrated this patch, regardless of release series, remains vulnerable. The flaw applies to the default io_uring implementation used by the kernel and thus affects all hosts running an unpatched kernel version.

The EPSS score of <1 % indicates a very low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is local or privileged: an attacker capable of submitting io_uring requests could craft a linked work chain, trigger IO_WQ_BIT_EXIT after the first item has begun, and cause the remaining work items to continue execution after the kernel has started to exit, leading to a denial‑of‑service condition such as a system stall or unchecked resource usage.