CVE-2026-52946: Linux Kernel SOFTIRQ-Unsafe Lock Order Denial of Service

Technical summary

The vulnerability is a lock-ordering deadlock in fs/fcntl.c affecting send_sigio() and send_sigurg() functions. Both functions call read_lock(&tasklist_lock) to traverse process groups when delivering FASYNC signals. The problem occurs because these functions are frequently invoked from softirq context—send_sigio() via input_inject_event and send_sigurg() via the TCP receive path (NET_RX_SOFTIRQ). The rwlock writer fairness mechanism creates the deadlock scenario: when a writer (fork/exit path) acquires write_lock(&tasklist_lock), it blocks all new readers. A softirq on a different CPU attempting to read-lock will deadlock because the writer is spinning. The fix replaces tasklist_lock with rcu_read_lock(), which is compatible with softirq context since RCU read-side critical sections are safe from interrupt handlers. This aligns process-group signaling with the existing single-PID signaling path, which already uses RCU protection for PID hashing and task traversal.

Business impact

A remotely-triggered denial-of-service condition affecting Linux kernel stability. An attacker can send specially crafted TCP packets with the URG flag set, potentially causing kernel deadlocks on systems where FASYNC signal delivery is active. While not a confidentiality or integrity breach, successful exploitation results in system hang or crash, impacting availability of services running on affected kernels. This is particularly relevant for network-facing systems, embedded devices, and virtualized environments relying on Linux. Organizations running affected kernel versions should prioritize mitigation to prevent unplanned downtime.

Affected systems

All Linux kernel versions that implement the vulnerable fasync signaling logic. The vulnerability affects the core kernel; no specific vendor-differentiated products are named in the advisory. Any system running a Linux kernel without the RCU-based fix is at risk, including cloud instances, servers, containers, and embedded systems. Organizations should verify kernel version against vendor patches (e.g., Ubuntu, Red Hat, Debian, SUSE) and their respective vulnerability advisories.

Exploitability

Exploitability is moderate to high. The vulnerability requires network access (CVSS AV:N) and can be triggered without authentication or user interaction. An attacker must craft TCP packets with URG flags or inject input events to reach the vulnerable code path. However, successful exploitation depends on timing—the deadlock requires concurrent operations (active reader holding tasklist_lock while a writer attempts to acquire it). Proof-of-concept exploitation is feasible but non-trivial, explaining why this is not yet listed in CISA's KEV catalog. The vulnerability is not known to be actively exploited in the wild based on current threat intelligence.

Remediation

Apply kernel patches that replace tasklist_lock with rcu_read_lock() in the fasync signaling path. Consult your Linux distribution's security advisory and patch availability (Ubuntu, Red Hat, Debian, SUSE, etc.). Kernel maintainers must backport the fix to stable branches. System administrators should plan kernel updates as part of regular maintenance cycles, prioritizing systems that are internet-facing or run latency-sensitive applications where denial-of-service has high impact.

Patch guidance

Patches are distribution-specific. Check the official security advisories from your Linux vendor (kernel.org, Ubuntu Security Notices, Red Hat Security Advisories, etc.) for the patched kernel version. The upstream fix involves modifying fs/fcntl.c to use rcu_read_lock() instead of read_lock(&tasklist_lock) in send_sigio() and send_sigurg(). After patching, reboot to activate the new kernel. If zero-downtime deployment is required, some environments (e.g., live kernel patching with kpatch/kGraft) may support in-place patching; verify support with your vendor.

Detection guidance

Monitor system logs for lockdep warnings or softirq timeout messages, which may indicate lock-ordering issues. Kernel hardening tools like lockdep (if enabled) will report the deadlock chain. Check for unusual increases in system hangs, CPU stalls, or unresponsive services. In production, network-level detection is difficult—focus on ensuring timely patching and validation in test environments. Consider kernel tracing tools (SystemTap, perf) in non-production labs to capture the deadlock signature if investigating suspected exploitation.

Why prioritize this

CVSS 7.5 (HIGH) with network-accessible denial-of-service impact warrants priority remediation, especially for critical infrastructure and customer-facing services. Although not in the KEV catalog, the vulnerability combines ease of trigger (network packets) with high availability impact. Organizations should patch within their standard maintenance windows but should not deprioritize in favor of lower-scoring vulns affecting the same systems. Virtualized environments and cloud workloads may face additional urgency if shared hosts are at risk.

Risk score, explained

CVSS 3.1 score of 7.5 reflects HIGH severity: the vulnerability requires no privileges or user interaction (PR:N, UI:N) and is network-accessible (AV:N). The attack vector is straightforward (TCP URG packets or input events). However, the impact is limited to availability (A:H) with no confidentiality or integrity loss (C:N, I:N), capping the score below critical. The complexity is low (AC:L) since the deadlock is inherent to the code logic rather than requiring a complex exploitation sequence. The overall assessment emphasizes the availability threat while acknowledging the absence of data exposure risk.

Frequently asked questions