CVE-2026-23473: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23473 is a race condition vulnerability in the Linux kernel's io_uring/poll subsystem affecting multishot recv operations on sockets. When a socket send and shutdown() occur back-to-back, both fire wake-ups before the receiver's task_work can run, causing the poll reference counter to be drained prematurely and the multishot recv to hang indefinitely. The CVE was published on April 3, 2026, and has subsequently been marked as Rejected by its CVE Numbering Authority (GitHub Advisory, EUVD). The ENISA EUVD entry records a base score of 0.0 reflecting the rejected status, while Feedly's estimate places it in the Medium severity range (Feedly).

The root cause is a race condition (CWE not formally assigned) in io_poll_check_events() within the Linux kernel's io_uring/poll subsystem. When a socket send and shutdown() happen in rapid succession, both events fire wake-ups before the receiver's task_work executes: the first wake-up acquires poll ownership (poll_refs=1) and the second increments it to 2. io_poll_issue() performs a recv that reads the data and returns IOU_RETRY, after which the loop drains all accumulated refs via atomic_sub_return(2) -> 0 and exits — consuming only the first event. Because socket shutdown is a persistent state change that generates no further wake-ups, the multishot recv operation hangs indefinitely. The fix adds an explicit HUP check in the poll loop and ensures an additional iteration occurs when more than one poll activation is pending (GitHub Advisory, EUVD).

Successful triggering of this race condition causes applications using io_uring multishot recv operations on sockets to hang indefinitely, resulting in a denial of service condition. There is no evidence of confidentiality or integrity impact; the vulnerability is limited to availability of the affected socket I/O operations. Any application or service relying on io_uring's multishot recv interface for network communication could become unresponsive if the race is triggered (GitHub Advisory, Feedly).

Patches are available in Linux kernel versions 6.18.20, 6.19.10, and 7.0-rc5, addressing the race condition via commits 0f4ce79b8db7b040373fc664c8bc6c5fd74bd196, bf33554b6abf7e7faeadd8af1b82037ea755a6bb, and a68ed2df72131447d131531a08fe4dfcf4fa4653 (EUVD). Downstream distributions including SUSE and Amazon Linux 2023 have issued updated packages (SUSE Advisory, Amazon Linux). For systems that cannot be patched immediately, limiting or avoiding the use of io_uring multishot recv operations on sockets is a viable interim workaround (Feedly).

The vulnerability was announced via the Linux kernel CVE mailing list and picked up by standard vulnerability tracking services including NVD, VulDB, and Tenable Nessus plugins (Tenable). The Yocto Project security mailing list also circulated notices regarding the issue (Yocto Security). No notable independent researcher commentary or significant social media discussion has been identified, consistent with the vulnerability's rejected CVE status and low exploitation risk.