CVE-2026-81010

Last refreshed2026-10-19

Status: UPDATED | Advisory ID: CVE-2026-81010

Key Details

CVE	CVE-2026-81010
CVSS Score / Version	7.8 (High) / CVSS v3.1
Updated	2026-10-19
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

io_uring/waitid: honor task_work cancellation

io_waitid_cb() may run through the fallback task_work path when

task_work_add() can no longer queue work to the originating task. The

fallback runs from a kworker and io_uring marks such task work as

canceled through tw.cancel.

io_waitid_cb() currently ignores tw.cancel and calls __do_wait().

waitid is task-context dependent: __do_wait() performs child lookup

relative to current, and the retry path also uses

current->signal->wait_chldexit. If the callback runs from the fallback

kworker, current is therefore not the task that submitted the request.

Honor tw.cancel before entering __do_wait(). Complete the request with

-ECANCELED and skip the siginfo copy, since canceled task work may run

without the submitting task's userspace execution context.

Keep the existing siginfo handling for normal waitid completion and

explicit cancellation. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-81010
CVE	https://www.cve.org/CVERecord?id=CVE-2026-81010

Source

Reference

NVD

CVE