CVE-2026-80920 io_uring: defer eventfd signaling when queued from a wakeup handler
A race condition in the Linux kernel io_uring subsystem can cause a deadlock or crash when eventfd signaling occurs within a wakeup handler.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80920?
CVE-2026-80920 is a vulnerability in Linux, published on 9 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
io_uring: defer eventfd signaling when queued from a wakeup handler
io_req_local_work_add() signals the CQ ring eventfd inline when it is the one to push the first entry onto ->work_list. For DEFER_TASKRUN rings that add is frequently done from a waitqueue wakeup handler, where an arbitrary waitqueue lock is held.
eventfd_signal_mask() only refuses to recurse when current->in_eventfd is set, but that bit is set by eventfd_signal_mask() itself. If the wake chain starts somewhere else, signal goes out inline and can feed back into epoll.
Add IOU_F_TWQ_IN_WAKE, set it on the task_work add done from the three waitqueue callbacks, and use it to force io_eventfd_signal() down the existing call_rcu_hurry() deferral instead of signaling inline.
Which versions are affected by CVE-2026-80920?
How do I fix CVE-2026-80920?
Apply the vendor's patch.
Is CVE-2026-80920 being exploited?
There is no known exploitation of CVE-2026-80920 in the wild and no public exploit code.
Sources
Also known as AZL-99963, BELL-CVE-2026-80920, DEBIAN-CVE-2026-80920, GHSA-xg24-c6qm-h882, UBUNTU-CVE-2026-80920.