# CVE-2026-99228: linux: In the Linux kernel, the following vulnerability has been resolved:  io_uring/io-wq: don't lose the signal that ends...

CVE-2026-99228 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-99228, released November 3, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-99228
- Priority: Routine
- CVSS: n/a
- EPSS: 0.0016
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Nov 2, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  io_uring/io-wq: don't lose the signal that ends work  When a thread exits, only its tracked requests are cancelled. Then its io-wq is torn down. io_wq_exit_workers() signals every worker, to get it out of an interruptible sleep, and waits for all of them to exit. Before they do, they go through the work that is left. Unbounded work is cancelled. Bounded work is run, as it is expected to end by itself.  Not all of it does. An open has no file yet, so it counts as bounded, and the open of a FIFO waits for the other end. That is what the signal is for. But the workers are signalled once, and a worker that hasn't started the work by then loses the signal:    io_wq_exit_workers()               io_worker_handle_work()     io_wq_worker_wake()       set TIF_NOTIFY_SIGNAL                                        io_assign_current_work()                                          io_run_task_work()                                            clear TIF_NOTIFY_SIGNAL                                        io_wq_submit_work()                                          fifo_open()                                            wait_for_partner()     wait_for_completion_timeout()  The thread never gets out of do_exit():    IORING_OP_OPENAT of a FIFO without a writer, IOSQE_ASYNC   exit of the thread that has submitted it  hangs in more than 9 of 10 attempts (4 CPUs, KVM), until the process is killed.  Set TIF_NOTIFY_SIGNAL for bounded work that is started with IO_WQ_BIT_EXIT set. The bit is set before the workers are signalled, and it is tested after the flag has been cleared, with clear_notify_signal() providing the barrier. So either the flag stays, or the bit is seen.  Work that is started while the io-wq exits is treated like work that is being run at that time: it isn't interrupted unless it waits interruptibly.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.12.115-1 | [DEBIAN-CVE-2026-99228](https://patchblox.com/security/data/fix/linux/debian-cve-2026-99228.md) | Nov 3, 2026 |
| Linux | linux Debian 14 | 7.2.14-1 | [DEBIAN-CVE-2026-99228](https://patchblox.com/security/data/fix/linux/debian-cve-2026-99228.md) | Nov 3, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.