CVE-2026-98858

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the io uring component when using SQPOLL. The sqpoll thread processes task work from its own list, allowing it to complete a request immediately after mpscq push() publishes it. If this is the final request keeping the ring active, io ring exit work() may free the context (ctx), stop the thread, and free the thread context (tctx) while io req normal work add() is still accessing them. This leads to a slab-use-after-free in the io req normal work add() and queue work on() functions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.