CVE-2026-99254: 
Linux Kernel 취약점 분석 및 완화

CVE-2026-99254 is a Denial of Service vulnerability in the Linux kernel's io_uring subsystem, caused by task_work flooding during the exit path. When io_ring_exit_work() attempts to remove task context nodes via task_work callbacks, io_tctx_exit_cb() re-queues itself immediately if the task is still in io_uring_cancel_generic(), creating an infinite callback loop. This affects Linux kernel versions starting from 5.12 up to (but not including) the patched stable releases. It carries a CVSS v3.1 base score of 5.5 (Medium), requiring only local access with low privileges (GitHub Advisory, Feedly).

The root cause is a logic flaw in the io_uring exit path where io_tctx_exit_cb() does not check whether the target task is already executing io_uring_cancel_generic() before re-queuing itself as task_work. Because task_work_run() only returns when the work list is empty, up to 64 concurrent work items can continuously re-queue callbacks to a single task, preventing it from ever completing cancellation. A reproducer involves creating 60 pairs of io_uring rings that poll each other, then calling exit_group() or execve() — this generated 280,000 callbacks in 5 seconds in testing. No special privileges are required to trigger this condition (GitHub Advisory). The fix introduces a delay before re-sending the callback when the task is detected to be in cancellation, breaking the tight loop.

Exploitation results in a sustained Denial of Service: the affected task monopolizes a CPU core executing hundreds of thousands of unnecessary callbacks, and cannot be killed while exiting. A live task executing execve() can similarly become stuck for minutes or longer. If the condition persists beyond five minutes, kernel WARN_ON_ONCE warnings are triggered via io_ring_exit_work(). The impact is limited to availability (no confidentiality or integrity loss), but the affected task and associated CPU resources remain blocked until all senders happen to be delayed simultaneously (GitHub Advisory, Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The vulnerability requires only local access with low privileges and no user interaction, making it accessible to any unprivileged local user on an affected system. The EPSS score is approximately 0.197% (9th percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Gain local access: Obtain a low-privileged shell on a system running a vulnerable Linux kernel (5.12 through versions prior to the patched stable releases).
2. Create polling ring pairs: Write a program that creates a large number of io_uring ring pairs (e.g., 60 pairs) configured to poll each other, establishing cross-ring dependencies where requests in one ring hold references to files of another ring.
3. Trigger exit path: Call exit_group() (or execve()) from the process owning the rings to initiate the io_uring teardown path.
4. Observe flooding: The io_ring_exit_work() function begins sending task_work callbacks to remove tctx nodes; because the task is in io_uring_cancel_generic(), io_tctx_exit_cb() immediately re-queues each callback, flooding the task with tens of thousands of callbacks per second.
5. Achieve DoS: The target task is pinned to a CPU executing callbacks indefinitely, unable to complete cancellation or be killed, causing sustained CPU exhaustion and potential system unresponsiveness (GitHub Advisory).

• Logs: Kernel log (dmesg) entries containing WARN_ON_ONCE(time_after(jiffies, timeout)) from io_ring_exit_work(), indicating the exit work exceeded the five-minute timeout threshold.
• Process Behavior: A process stuck in an uninterruptible or unkillable state for an extended period (minutes) following exit_group() or execve(), visible via ps aux showing the process in D or zombie-like state.
• CPU Metrics: Sustained 100% CPU utilization on a single core attributed to a process that should have exited, observable via top, htop, or perf.
• Kernel Tracing: High-frequency invocations of io_tctx_exit_cb and task_work_run visible through kernel tracing tools such as ftrace or perf trace.

Patches have been backported to multiple stable kernel branches. The fixed versions are: 6.1.191, 6.6.161, 6.12.115, 6.18.60, 7.2.14, 7.3.2, and 7.4-rc1 and later. Microsoft's Azure Linux 3 kernel package azl3_kernel_6.6.159.1-1 is also affected and should be updated. As an interim workaround, administrators can restrict unprivileged access to io_uring via sysctl -w kernel.io_uring_disabled=1 (where supported) or limit io_uring usage through seccomp policies or cgroup restrictions for untrusted users (GitHub Advisory, Microsoft MSRC).