CVE-2026-99255: 
Linux Kernel 취약점 분석 및 완화

CVE-2026-99255 is a race condition vulnerability in the Linux kernel's io_uring/io-wq subsystem that can cause a task to hang indefinitely and become unkillable, resulting in a denial of service. The flaw was published on November 3, 2026, and affects Linux kernel versions starting from 5.5 up to multiple stable branches. Fixed versions include 6.1.191, 6.6.161, 6.12.115, 6.18.60, 7.2.14, 7.3.2, and 7.4-rc1. It carries a CVSS v3.1 base score of 4.7 (Medium) (GitHub Advisory, Feedly).

The root cause is a race condition (no formal CWE assigned) in the io_uring/io-wq request cancellation path. When io-wq finishes processing a request that has a linked follow-up request, there is a brief window during io_worker_handle_work() where the linked request is neither pending, assigned as a worker's current work, nor on any parking list — making it invisible to io_uring_cancel_generic(). If a task's exit cancellation pass occurs during this window, it finds nothing to cancel and goes to sleep; the worker then executes the linked request (which IO_WQ_BIT_EXIT does not prevent for bounded work), potentially parking it without completing or freeing it, and without waking the sleeping task. The fix splits io_wq_free_work() into two phases so the request is only freed once the linked request is visible as the worker's current work or is pending, ensuring cancellation logic can always locate it (GitHub Advisory).

Successful exploitation causes the affected task to sleep indefinitely waiting for a request that will never complete or be freed, resulting in a denial of service. If the affected task is the process itself (rather than a thread), the process becomes unkillable — it cannot be terminated even with SIGKILL. Testing showed that with four linked NOP/FUTEX_WAIT io_uring operations per round, 5 to 8 out of 10,000 rounds hang on a 4-CPU KVM system, demonstrating a realistic and reproducible availability impact (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The vulnerability requires local access with low privileges (PR:L) and high attack complexity (AC:H) due to the narrow timing window of the race condition. The EPSS score is approximately 0.197% (9th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Gain local access: Obtain a low-privileged local account on a vulnerable Linux system running kernel version 5.5 or later (before the patched versions).
2. Craft io_uring submission: Create an io_uring instance and submit a linked chain of requests — for example, a NOP with IOSQE_ASYNC | IOSQE_IO_LINK followed by a FUTEX_WAIT operation — designed to trigger the race window during task exit.
3. Trigger task exit during the race window: Exit the thread or process (within approximately 63µs of the linked request transition) so that io_uring_cancel_generic() runs its cancellation pass precisely when the linked request is in the invisible state between io_req_find_next() and io_assign_current_work(worker, linked).
4. Induce hang: The cancellation pass finds no request to cancel and the task sleeps. The io-wq worker executes the linked request, parks it without completing or freeing it, and never wakes the sleeping task — leaving the process unkillable (GitHub Advisory).

• Process: Processes in uninterruptible sleep (D state) or zombie state that cannot be killed with SIGKILL, particularly those that previously used io_uring.
• Logs: Kernel logs (dmesg) showing io_uring-related warnings or hung task messages (e.g., INFO: task <name>:<pid> blocked for more than 120 seconds).
• System: Repeated failed attempts to terminate a specific process via signals; ps aux showing a process stuck in D (disk sleep) state indefinitely with io_uring-related stack traces visible via /proc/<pid>/wchan or cat /proc/<pid>/stack.

Update the Linux kernel to a patched version: 6.1.191, 6.6.161, 6.12.115, 6.18.60, 7.2.14, 7.3.2, or 7.4-rc1 and later. The fix is available via stable kernel git commits including 98470f164286, d39ebc7a583d, ebe8e97fb99d, 3e02b8df0e9f, 92e20e9c72bd, 59e45f44c3ce, and 436d48a2ed13. Microsoft's Azure Linux 3 kernel package azl3_kernel_6.6.159.1-1 is also affected and should be updated per the Microsoft Security Response Center advisory. No configuration-based workaround is known; patching is the only remediation (GitHub Advisory, Microsoft MSRC).