CVE-2026-98858: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-98858 is a use-after-free vulnerability in the Linux kernel's io_uring subsystem, specifically in task_work handling when the SQPOLL (Submission Queue polling) thread is in use. When the SQPOLL thread completes the last request holding a ring alive, io_ring_exit_work() can free the context (ctx) and stop the thread while io_req_normal_work_add() is still accessing the freed memory, triggering KASAN slab-use-after-free violations. The vulnerability was disclosed on October 18, 2026, and affects Linux kernel versions starting from 6.9. A CVSS base score has not yet been formally assigned (estimated Medium severity), and the EPSS score is 0.0 (Github Advisory, Feedly).

The root cause is a race condition leading to a use-after-free (CWE-416) in the io_uring SQPOLL path. The SQPOLL thread processes task_work from its own list independently and can complete a request — including the last one keeping the ring context alive — immediately after mpscq_push() publishes it. This allows io_ring_exit_work() to free the ctx and tctx structures while io_req_normal_work_add() is still reading and writing to them, as evidenced by KASAN reports showing reads at io_req_normal_work_add+0x439/0x510 and writes in queue_work_on+0x25/0x70. The fix involves holding an RCU read lock across the task_work add operation (mirroring the existing protection in io_req_local_work_add()) and requiring io_ring_exit_work() to wait for an RCU grace period before freeing the context in SQPOLL rings (Github Advisory).

A local attacker with access to io_uring (which typically requires no special privileges on systems where io_uring is enabled) can trigger the use-after-free condition by crafting specific io_uring operations with SQPOLL that cause premature context freeing. Successful exploitation can result in memory corruption and potentially arbitrary code execution with the privileges of the affected process, impacting confidentiality, integrity, and availability of the affected system. The vulnerability is confined to the local attack surface but could be leveraged for privilege escalation or kernel-level code execution (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The EPSS score is 0.0, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to a system with io_uring enabled, which is the default on many modern Linux distributions (Github Advisory).

Apply the upstream Linux kernel patches that introduce RCU read lock protection in io_req_normal_work_add() and add an RCU grace period wait in io_ring_exit_work() for SQPOLL rings. Fixed versions include Linux kernel 6.12.113, 6.18.56, 7.2.10, and 7.3-rc6 or later. As a workaround where patching is not immediately possible, disabling io_uring (e.g., via sysctl -w kernel.io_uring_disabled=1) eliminates the attack surface entirely (Github Advisory, Feedly).