CVE-2026-23113

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop

Currently this is checked before running the pending work. Normally this

is quite fine, as work items either end up blocking (which will create a

new worker for other items), or they complete fairly quickly. But syzbot

reports an issue where io-wq takes seemingly forever to exit, and with a

bit of debugging, this turns out to be because it queues a bunch of big

(2GB - 4096b) reads with a /dev/msr* file. Since this file type doesn't

support ->read_iter(), loop_rw_iter() ends up handling them. Each read

returns 16MB of data read, which takes 20 (!!) seconds. With a bunch of

these pending, processing the whole chain can take a long time. Easily

longer than the syzbot uninterruptible sleep timeout of 140 seconds.

This then triggers a complaint off the io-wq exit path:

INFO: task syz.4.135:6326 blocked for more than 143 seconds.

Not tainted syzkaller #0

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References