CVE-2026-23113: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23113 is a denial-of-service vulnerability in the Linux kernel's io_uring/io-wq subsystem caused by the IO_WQ_BIT_EXIT flag not being checked within the work run loop. Discovered and disclosed on February 14, 2026, it affects Linux kernel versions 5.12.1 through 6.6.121, 6.7 through 6.12.67, and 6.13 through 6.18.7. The vulnerability was identified via syzbot fuzzing and has a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is an improper resource control issue (CWE-400: Uncontrolled Resource Consumption) in the io_worker_handle_work() loop of the Linux kernel's io-wq subsystem. The IO_WQ_BIT_EXIT flag is only evaluated before processing pending work items, not during the loop itself. When a work item involves a file type that does not support ->read_iter() (such as /dev/msr*), the loop_rw_iter() fallback is used, which can process reads of up to 2GB–4096 bytes at approximately 16MB per 20 seconds per operation. A local attacker can queue many such large I/O operations, causing the io-wq exit path to stall in an uninterruptible sleep state well beyond the kernel's hung task timeout (140 seconds in syzbot's configuration), triggering a hung task warning (Feedly).

Successful exploitation causes a denial of service by forcing the Linux kernel's io-wq subsystem into an indefinite uninterruptible sleep state during exit processing. This prevents proper kernel task shutdown, causes hung task detection warnings (INFO: task blocked for more than 143 seconds), and renders affected applications unresponsive. There is no confidentiality or integrity impact; the vulnerability is limited to availability (Feedly).

1. Gain local access: Obtain a low-privileged local user account on a vulnerable Linux system (kernel versions 5.12.1–6.6.121, 6.7–6.12.67, or 6.13–6.18.7).
2. Identify target device: Confirm access to /dev/msr* or similar device files that do not support ->read_iter() and fall back to loop_rw_iter().
3. Queue large I/O operations via io_uring: Use the io_uring interface to submit a large number of read requests (e.g., 2GB–4096 bytes each) targeting the identified device file.
4. Trigger exit stall: Initiate process exit while the io-wq worker queue is saturated with long-running operations. Because IO_WQ_BIT_EXIT is not checked within the work loop, the kernel will not cancel pending items and will remain in an uninterruptible sleep state.
5. Achieve denial of service: The system's hung task detector fires after the configured timeout (e.g., 140 seconds), and the affected task or application becomes unresponsive, potentially requiring a reboot (Feedly).

• Logs: Kernel log entries such as INFO: task <name>:<pid> blocked for more than N seconds and Blocked by coredump in /var/log/kern.log or dmesg output; stack traces referencing io_worker_handle_work, loop_rw_iter, __schedule, and context_switch in kernel logs.
• Process: Processes in uninterruptible sleep state (D state) visible via ps aux or top, associated with io_uring workloads; unusually long-running worker threads in the io-wq subsystem.
• File System: Unusual or repeated access to /dev/msr* device files by unprivileged processes, particularly with very large read sizes.
• Network: No network-based indicators; this is a local exploitation vector only (Feedly).

Apply kernel updates to the following fixed versions: 6.6.122 or later (for the 5.12.1–6.6.x branch), 6.12.68 or later (for the 6.7–6.12.x branch), or 6.18.8 or later (for the 6.13+ branch). Patch commits are available at git.kernel.org (commits 10dc9593, 2e8ca107, 85eb8369, bdf0bf73). As a temporary workaround for systems that cannot be immediately patched, restrict unprivileged user access to /dev/msr* and similar device files, limit the number of concurrent io_uring operations, and monitor kernel logs for hung task warnings (Feedly, Kernel Patch).