{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23473", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:46.022Z", "datePublished": "2026-04-03T15:15:51.928Z", "dateUpdated": "2026-04-03T15:15:51.928Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-04-03T15:15:51.928Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/poll: fix multishot recv missing EOF on wakeup race\n\nWhen a socket send and shutdown() happen back-to-back, both fire\nwake-ups before the receiver's task_work has a chance to run. The first\nwake gets poll ownership (poll_refs=1), and the second bumps it to 2.\nWhen io_poll_check_events() runs, it calls io_poll_issue() which does a\nrecv that reads the data and returns IOU_RETRY. The loop then drains all\naccumulated refs (atomic_sub_return(2) -> 0) and exits, even though only\nthe first event was consumed. Since the shutdown is a persistent state\nchange, no further wakeups will happen, and the multishot recv can hang\nforever.\n\nCheck specifically for HUP in the poll loop, and ensure that another\nloop is done to check for status if more than a single poll activation\nis pending. This ensures we don't lose the shutdown event."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["io_uring/poll.c"], "versions": [{"version": "dbc2564cfe0faff439dc46adb8c009589054ea46", "lessThan": "0f4ce79b8db7b040373fc664c8bc6c5fd74bd196", "status": "affected", "versionType": "git"}, {"version": "dbc2564cfe0faff439dc46adb8c009589054ea46", "lessThan": "bf33554b6abf7e7faeadd8af1b82037ea755a6bb", "status": "affected", "versionType": "git"}, {"version": "dbc2564cfe0faff439dc46adb8c009589054ea46", "lessThan": "a68ed2df72131447d131531a08fe4dfcf4fa4653", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["io_uring/poll.c"], "versions": [{"version": "5.19", "status": "affected"}, {"version": "0", "lessThan": "5.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.20", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.10", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0-rc5", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.18.20"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.19.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "7.0-rc5"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0f4ce79b8db7b040373fc664c8bc6c5fd74bd196"}, {"url": "https://git.kernel.org/stable/c/bf33554b6abf7e7faeadd8af1b82037ea755a6bb"}, {"url": "https://git.kernel.org/stable/c/a68ed2df72131447d131531a08fe4dfcf4fa4653"}], "title": "io_uring/poll: fix multishot recv missing EOF on wakeup race", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/poll: fix multishot recv missing EOF on wakeup race\n\nWhen a socket send and shutdown() happen back-to-back, both fire\nwake-ups before the receiver's task_work has a chance to run. The first\nwake gets poll ownership (poll_refs=1), and the second bumps it to 2.\nWhen io_poll_check_events() runs, it calls io_poll_issue() which does a\nrecv that reads the data and returns IOU_RETRY. The loop then drains all\naccumulated refs (atomic_sub_return(2) -> 0) and exits, even though only\nthe first event was consumed. Since the shutdown is a persistent state\nchange, no further wakeups will happen, and the multishot recv can hang\nforever.\n\nCheck specifically for HUP in the poll loop, and ensure that another\nloop is done to check for status if more than a single poll activation\nis pending. This ensures we don't lose the shutdown event."}], "id": "CVE-2026-23473", "lastModified": "2026-04-03T16:16:35.120", "metrics": {}, "published": "2026-04-03T16:16:35.120", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0f4ce79b8db7b040373fc664c8bc6c5fd74bd196"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a68ed2df72131447d131531a08fe4dfcf4fa4653"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bf33554b6abf7e7faeadd8af1b82037ea755a6bb"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: io_uring/poll: fix multishot recv missing EOF on wakeup race", "id": "2454821", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454821"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-367", "details": ["A flaw was found in the Linux kernel's `io_uring/poll` subsystem. A race condition can occur when a socket performs send and shutdown operations in quick succession. This can cause a multishot receive operation to hang indefinitely, leading to a Denial of Service (DoS) for affected systems."], "name": "CVE-2026-23473", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23473\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23473\nhttps://lore.kernel.org/linux-cve-announce/2026040323-CVE-2026-23473-ab6c@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[dbc2564cfe0faff439dc46adb8c009589054ea46,0f4ce79b8db7b040373fc664c8bc6c5fd74bd196)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[dbc2564cfe0faff439dc46adb8c009589054ea46,bf33554b6abf7e7faeadd8af1b82037ea755a6bb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[dbc2564cfe0faff439dc46adb8c009589054ea46,a68ed2df72131447d131531a08fe4dfcf4fa4653)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.20,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.10,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-03T18:40:24.476494+00:00", "value": {"mitigation_remediation": ["Update the Linux kernel to a version where the patch is applied", "Verify the kernel version matches the fix commit identifiers", "Consider disabling io_uring in affected workloads until the kernel is updated"], "summary": {"action": "Apply patch", "impact": "Denial of Service via multishot recv hang"}, "threat_synthesis": {"affected_systems": "The flaw affects all Linux kernel distributions. Any system running a kernel that includes the io_uring/poll code without the applied fix is vulnerable. The precise kernel versions are not enumerated in the data, so all recent releases prior to the fix are considered at risk.", "description_and_impact": "A race condition exists in the Linux kernel's io_uring/poll implementation. When a socket is sent to and immediately shut down, two wake\u2011ups occur before the receiver task can process them. The first wake acquires poll ownership, the second increments it, and when the poll loop checks for events it processes only one receive and then exits, discarding the shutdown event. As no further wake\u2011ups will happen, the multishot receive loop can hang indefinitely, effectively blocking the application or service that relies on the socket. This results in a denial of service condition for the affected process.", "risk_and_exploitability": "The vulnerability is a concurrency race that can lead to a complete service blockage. No publicly disclosed exploit path is provided, and the EPSS score is unavailable; however, the nature of the defect means that any code using multishot io_uring poll operations could be impacted. The CISA KEV catalog does not list it, which suggests it may not yet have been widely exploited. Nonetheless, the potential for a denial of service in a kernel context warrants immediate attention."}}}}, "created": "2026-04-03T21:13:26.008007+00:00", "updated": "2026-04-03T21:15:40.998305+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-362"]}