CVE-2026-52946 fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
A race condition in Linux kernel fasync signaling can cause a deadlock, leading to denial of service via TCP URG packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-52946?
CVE-2026-52946 is a high-severity vulnerability in Linux kernel, published on 24 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
A SOFTIRQ-safe to SOFTIRQ-unsafe lock order deadlock can occur in send_sigio() and send_sigurg() when a process group receives a signal.
When FASYNC is configured for a process group (PIDTYPE_PGID), both functions use read_lock(&tasklist_lock) to traverse the task list. However, they are frequently called from softirq context: - send_sigio() via input_inject_event -> kill_fasync - send_sigurg() via tcp_check_urg -> sk_send_sigurg (NET_RX_SOFTIRQ)
The deadlock is caused by the rwlock writer fairness mechanism: 1. CPU 0 (process context) holds read_lock(&tasklist_lock) in do_wait(). 2. CPU 1 (process context) attempts write_lock(&tasklist_lock) in fork() or exit() and spins, which blocks all new readers. 3. CPU 0 is interrupted by a softirq (e.g., TCP URG packet reception). 4. The softirq calls send_sigurg() and attempts to acquire read_lock(&tasklist_lock), deadlocking because CPU 1 is waiting.
Since PID hashing and do_each_pid_task() traversals are already RCU-protected, the read_lock on tasklist_lock is no longer strictly required for safe traversal. Fix this by replacing tasklist_lock with rcu_read_lock(), aligning the process group signaling path with the single-PID path. This also mitigates a potential remote denial of service vector via TCP URG packets.
Lockdep splat: ===================================================== WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected [...] Chain exists of: &dev->event_lock --> &f_owner->lock --> tasklist_lock
Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(tasklist_lock); local_irq_disable(); lock(&dev->event_lock); lock(&f_owner->lock); <Interrupt> lock(&dev->event_lock);
*** DEADLOCK ***
Which versions are affected by CVE-2026-52946?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-52946?
Apply the vendor's patch.
Is CVE-2026-52946 being exploited?
There is no known exploitation of CVE-2026-52946 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-90684, BELL-CVE-2026-52946, DEBIAN-CVE-2026-52946, GHSA-9h35-hqff-9v3w, ROOT-OS-DEBIAN-11-CVE-2026-52946, ROOT-OS-DEBIAN-12-CVE-2026-52946 and 3 more.