CVE-2026-80920

In the Linux kernel, the following vulnerability has been resolved:

io_uring: defer eventfd signaling when queued from a wakeup handler

io_req_local_work_add() signals the CQ ring eventfd inline when it is the

one to push the first entry onto ->work_list. For DEFER_TASKRUN rings that

add is frequently done from a waitqueue wakeup handler, where an

arbitrary waitqueue lock is held.

eventfd_signal_mask() only refuses to recurse when current->in_eventfd

is set, but that bit is set by eventfd_signal_mask() itself. If the wake

chain starts somewhere else, signal goes out inline and can feed back

into epoll.

Add IOU_F_TWQ_IN_WAKE, set it on the task_work add done from the three

waitqueue callbacks, and use it to force io_eventfd_signal() down the

existing call_rcu_hurry() deferral instead of signaling inline.