CVE-2026-98858

Что произошло

In the Linux kernel, the following vulnerability has been resolved: io_uring: fix task_work add use-after-free with SQPOLL For SQPOLL, the sqpoll thread runs task_work off its own list and doesn't need to be told about it, so it can pop and complete a request as soon as mpscq_push() has published it. If that was the last request holding the ring alive, io_ring_exit_work() then frees the ctx, stops the thread, and with it the tctx, while io_req_normal_work_add() is still looking at both after the push: BUG: KASAN: slab-use-after-free in io_req_normal_work_add+0x439/0x510 Read of size 4 at addr ff11000000ca0000 by task repro/55 (...) BUG: KASAN: slab-use-after-free in queue_work_on+0x25/0x70 Write of size 8 at addr ff11000000c3bd00 by task repro/55 Hold an RCU read lock across the add, like io_req_local_work_add() already does, and have io_ring_exit_work() wait for a grace period for SQPOLL rings as well before freeing the ctx.

Что делать

dpkg-query -W -f='${Package}	${Version}\n'

rpm -qa --qf '%{NAME}\t%{VERSION}-%{RELEASE}\n'

Get-HotFix | Select-Object HotFixID, InstalledOn

Продукты и затронутые версии

{
  "status": "affected",
  "version": "af5d68f8892f8ee8f137648b79ceb2abc153a19b",
  "lessThan": "42b3332efacfd2140be4cd0dedad4fb96b8ae90e",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "af5d68f8892f8ee8f137648b79ceb2abc153a19b",
  "lessThan": "891bd8335a0de3bb15c3b797ce3026bbb0dbef6c",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "af5d68f8892f8ee8f137648b79ceb2abc153a19b",
  "lessThan": "395b25968fe854d4efaa19a8e9b7a5b6d1b3eea3",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "af5d68f8892f8ee8f137648b79ceb2abc153a19b",
  "lessThan": "a92193c91e8839fe5fc209616ea95465ae4b919d",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "6.9"
}

{
  "status": "unaffected",
  "version": "0",
  "lessThan": "6.9",
  "versionType": "semver"
}

{
  "status": "unaffected",
  "version": "6.12.113",
  "versionType": "semver",
  "lessThanOrEqual": "6.12.*"
}

{
  "status": "unaffected",
  "version": "6.18.56",
  "versionType": "semver",
  "lessThanOrEqual": "6.18.*"
}

{
  "status": "unaffected",
  "version": "7.2.10",
  "versionType": "semver",
  "lessThanOrEqual": "7.2.*"
}

{
  "status": "unaffected",
  "version": "7.3",
  "versionType": "original_commit_for_fix",
  "lessThanOrEqual": "*"
}

CVSS: оценки и векторы

Оценка CVSS отсутствует.

Источники и ссылки

{
  "cwes": [],
  "epss": {
    "source": "epss",
    "received_at": "2026-11-02T21:15:49.069161+00:00"
  },
  "title": {
    "source": "cve",
    "received_at": "2026-10-28T20:15:08.449452+00:00"
  },
  "scores": [],
  "status": {
    "source": "cve",
    "received_at": "2026-10-28T20:15:08.449452+00:00"
  },
  "affected": [
    "cve"
  ],
  "published": {
    "source": "cve",
    "received_at": "2026-10-28T20:15:08.449452+00:00"
  },
  "solutions": [],
  "percentile": {
    "source": "epss",
    "received_at": "2026-11-02T21:15:49.069161+00:00"
  },
  "references": [
    "cve"
  ],
  "description": {
    "source": "cve",
    "received_at": "2026-10-28T20:15:08.449452+00:00"
  },
  "workarounds": [],
  "configurations": []
}

Хронология записи

1. Данные обновлены03.11.2026, 00:15
2. Данные обновлены02.11.2026, 00:13
3. Данные обновлены31.10.2026, 12:00
4. Данные обновлены29.10.2026, 12:47
5. Опубликована28.10.2026, 23:15

Личная заметка и статус

Другие CVE того же продукта