CVE-2026-80920

In the Linux kernel, the following vulnerability has been resolved:

io uring: defer eventfd signaling when queued from a wakeup handler

io req local work add() signals the CQ ring eventfd inline when it is the one to push the first entry onto ->work list. For DEFER TASKRUN rings that add is frequently done from a waitqueue wakeup handler, where an arbitrary waitqueue lock is held.

eventfd signal mask() only refuses to recurse when current->in eventfd is set, but that bit is set by eventfd signal mask() itself. If the wake chain starts somewhere else, signal goes out inline and can feed back into epoll.

Add IOU F TWQ IN WAKE, set it on the task work add done from the three waitqueue callbacks, and use it to force io eventfd signal() down the existing call rcu hurry() deferral instead of signaling inline.