AEGLIX vulnerability intelligence
CVE-2026-99228
UNSCORED · Received
Published: 2026-11-02 · Updated: 2026-11-02 · Source: NVD
Stored catalog record
Source record retrieved 2026-11-02T19:29:44.614759+00:00. Scheduled imports handle updates; this page does not assert that the provider was queried just now.
Continue your research
Connect this record to stored reporting, reviewed campaign mentions and source-domain investigation. These are research leads, not inferred attack relationships.
Open CVE research in Investigate · Find Arsenal listings referencing this CVE
Vulnerability overview
In the Linux kernel, the following vulnerability has been resolved: io_uring/io-wq: don't lose the signal that ends work When a thread exits, only its tracked requests are cancelled. Then its io-wq is torn down. io_wq_exit_workers() signals every worker, to get it out of an interruptible sleep, and waits for all of them to exit. Before they do, they go through the work that is left. Unbounded work is cancelled. Bounded work is run, as it is expected to end by itself. Not all of it does. An open has no file yet, so it counts as bounded, and the open of a FIFO waits for the other end. That is what the signal is for. But the workers are signalled once, and a worker that hasn't started the work by then loses the signal: io_wq_exit_workers() io_worker_handle_work() io_wq_worker_wake() set TIF_NOTIFY_SIGNAL io_assign_current_work() io_run_task_work() clear TIF_NOTIFY_SIGNAL io_wq_submit_work() fifo_open() wait_for_partner() wait_for_completion_timeout() The thread never gets out of do_exit(): IORING_OP_OPENAT of a FIFO without a writer, IOSQE_ASYNC exit of the thread that has submitted it hangs in more than 9 of 10 attempts (4 CPUs, KVM), until the process is killed. Set TIF_NOTIFY_SIGNAL for bounded work that is started with IO_WQ_BIT_EXIT set. The bit is set before the workers are signalled, and it is tested after the flag has been cleared, with clear_notify_signal() providing the barrier. So either the flag stays, or the bit is seen. Work that is started while the io-wq exits is treated like work that is being run at that time: it isn't interrupted unless it waits interruptibly.
Patch review priority
Assess exposure and vendor guidance
- No higher-priority signal is available in the current stored evidence.
- Fresh EPSS data is unavailable; missing values are not zero.
EPSS unavailable; no zero score is assumed.
EPSS estimates probability of exploitation in the next 30 days. It does not measure your exposure or prove exploitation. The elevated threshold is 10%; CISA KEV takes precedence. About FIRST EPSS ↗
Severity and scoring
- CVSS score
- Not scored · UNSCORED
- CVSS version
- Not supplied
- CVSS vector
- Not supplied
- Weaknesses
- Not supplied
CVSS measures technical severity; it does not establish whether this vulnerability is being exploited in your environment.
Known exploitation and remediation
Not listed in the CISA catalog retrieved for this record. This does not establish that exploitation has not occurred.
Verify affected versions and patch availability in the vendor advisory before making changes.
Affected products and versions
NVD has not supplied affected-version configurations for this record. Check the vendor references below.
Advisories and references
- https://git.kernel.org/stable/c/08c42055b8f9a5d29236d34ad4bce08828239fe1
- https://git.kernel.org/stable/c/62996803c1b5f18176de255db4c843021f2d19c8
- https://git.kernel.org/stable/c/7309fea05a3d66af9746843c43fef14c10b8141e
- https://git.kernel.org/stable/c/ddccc60f036b309430cf130d48aafed94ef7355a
- https://git.kernel.org/stable/c/fdb771015c1e13677b57a4015f0c938748f13781