CVE-2026-46274: io-wq: check that the predecessor is hashed in io_wq_remove_pending()

Synopsis

A use-after-free vulnerability exists in the Linux kernel's io-wq (io_uring work queue) subsystem, reachable by a local user with a low-privilege account. The bug arises when a hashed bucket-0 work item is cancelled while a non-hashed predecessor sits immediately before it in the work list; a missing hash-check causes a dangling pointer to be stored in wq->hash_tail[0], which persists for the lifetime of the task. When the next hashed bucket-0 item is enqueued, the kernel dereferences the freed memory, giving an attacker the ability to read arbitrary kernel memory, corrupt kernel data structures, or crash the system. A patched-image rebuild at the fix versions is available on HarborGuard for environments running affected kernel versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the vulnerable service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to trigger the vulnerable io_uring work queue code path.

• Victim interactionNot required

  No user interaction is needed; the attacker can trigger the bug entirely through their own process without involving another user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race-condition timing or unusual environmental conditions.

Blast Radius

• Reads arbitrary kernel memory, exposing sensitive data such as cryptographic keys, process credentials, or other in-kernel structures.
• Corrupts kernel data structures by writing through freed memory, enabling privilege escalation to root.
• Crashes the affected kernel, causing a full system denial of service for all processes on the host.
• The dangling pointer persists for the lifetime of the task, so exploitation windows extend well beyond the initial triggering operation.