CVE-2026-46274

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.0.12-1.1

Description A flaw exists in the io wq remove pending() function where it fails to verify if a predecessor entry is hashed when updating the wq->hash tail[] array. When a hashed bucket-0 work item is cancelled and its list predecessor is non-hashed, the system incorrectly stores a pointer to the non-hashed io kiocb in wq->hash tail[0]. Since non-hashed work is handled via a fast path that does not modify hash tail[], this results in a dangling pointer after the io kiocb is freed. Because the io wq is per-task and persists across ring open/close operations, subsequent hashed bucket-0 enqueues in io wq insert work() may dereference this pointer, leading to a write-through of freed memory via wq list add after().

Recommendations Update to version 7.0.12-1.1.