CVE-2026-46274
Description
A flaw was found in the Linux kernel's input/output work queue (io-wq) component. This vulnerability occurs because the system incorrectly handles work queue entries, leading to a stale pointer. A local attacker could exploit this issue by manipulating work queue operations. Successful exploitation could allow the attacker to write to freed memory, potentially leading to privilege escalation or a system crash (denial of service).
Statement
An io-wq use-after-free can occur when io_wq_remove_pending updates hash_tail for a hashed bucket-0 work item using a predecessor that is not hashed. A non-hashed predecessor can then be dequeued without clearing hash_tail, later freed back to req_cachep, and the next hashed bucket-0 enqueue can write through the dangling pointer. For the CVSS the PR:L because a local user or local process with access to io_uring is needed to create and cancel the relevant work items. Impact is at least local denial of service via kernel crash and may allow privilege escalation because the primitive is a kernel use-after-free with a write through freed memory. For the Red Hat Enterprise Linux the related Kernel config param CONFIG_IO_WQ disabled, so the bug not actual ("not affected").
Mitigation
For the Red Hat Enterprise Linux the related Kernel config param CONFIG_IO_WQ disabled, so the bug not actual ("not affected").
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.8 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory
If the expired pointer is used in a read operation, an attacker might be able to control data read in by the application.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
If the expired pointer references a memory location that is not accessible to the product, or points to a location that is "malformed" (such as NULL) or larger than expected by a read or write operation, then a crash may occur.
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
If the expired pointer is used in a function call, or points to unexpected data in a write operation, then code execution may be possible.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
