---
id: CVE-2026-80920
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  io_uring: defer eventfd signaling when queued from a wakeup handler

  io_req_local_work_add() signals the CQ ring eventfd inline when it is the
  one to push the first ent…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  io_uring: defer eventfd signaling when queued from a wakeup handler

  io_req_local_work_add() signals the CQ ring eventfd inline when it is the
  one to push the first ent…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 21a091b970cdbcf3e8ff829234b51be6f9192766 <
    e22f4494cc9487d326e5e3067f33dea7c1e442b2
  - >-
    Linux >= 21a091b970cdbcf3e8ff829234b51be6f9192766 <
    b6bb334b0e9348887e3e55e1f494b0c3b8fbf59f
  - >-
    Linux >= 21a091b970cdbcf3e8ff829234b51be6f9192766 <
    40b6ccf68731809ceb85c6e9f0f8f2ed61c7aa5a
  - >-
    Linux >= 21a091b970cdbcf3e8ff829234b51be6f9192766 <
    cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e
  - Linux 6.1
published: '2026-09-09'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T17:17:47.120'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80920'
references:
  - url: 'https://git.kernel.org/stable/c/40b6ccf68731809ceb85c6e9f0f8f2ed61c7aa5a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b6bb334b0e9348887e3e55e1f494b0c3b8fbf59f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e22f4494cc9487d326e5e3067f33dea7c1e442b2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-09T17:16:03.091Z'
epss: 0.00156
epssPercentile: 0.05215
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

io_uring: defer eventfd signaling when queued from a wakeup handler

io_req_local_work_add() signals the CQ ring eventfd inline when it is the
one to push the first entry onto ->work_list. For DEFER_TASKRUN rings that
add is frequently done from a waitqueue wakeup handler, where an
arbitrary waitqueue lock is held.

eventfd_signal_mask() only refuses to recurse when current->in_eventfd
is set, but that bit is set by eventfd_signal_mask() itself. If the wake
chain starts somewhere else, signal goes out inline and can feed back
into epoll.

Add IOU_F_TWQ_IN_WAKE, set it on the task_work add done from the three
waitqueue callbacks, and use it to force io_eventfd_signal() down the
existing call_rcu_hurry() deferral instead of signaling inline.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.