---
id: CVE-2026-97619
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  io_uring/rw: end write accounting from ->ki_complete

  Commit b000145e9907 moved both the fsnotify calls and the write
  accounting out of the kiocb completion handler and…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  io_uring/rw: end write accounting from ->ki_complete

  Commit b000145e9907 moved both the fsnotify calls and the write
  accounting out of the kiocb completion handler and…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-833
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= b000145e9907809406d8164c3b2b8861d95aecd1 <
    696459029f3b65c070c91b729478475582f1dcdf
  - >-
    Linux >= b000145e9907809406d8164c3b2b8861d95aecd1 <
    cc580cee4dfa2ec9099c30ecbd4d804cbb996432
  - >-
    Linux >= b000145e9907809406d8164c3b2b8861d95aecd1 <
    055d43a1233edbd80e558889258105ce63051bcd
  - >-
    Linux >= b000145e9907809406d8164c3b2b8861d95aecd1 <
    796aa0547557e63338657ed1c487906f9fac4c73
  - Linux ea2e6286e3e89a115ae554e20ba9aec2b2e1ddff
  - Linux 89a410dbd0f159ddd308f19d6eb682fc753e4771
  - Linux 2a853c206e553dd9c0a55c22858fd6a446d93e15
  - Linux >= 5.10.165 < 5.11
  - Linux >= 5.15.90 < 5.16
  - Linux >= 6.0.3 < 6.1
  - Linux 6.1
published: '2026-09-25'
updated: '2026-10-03'
sourceUpdated: '2026-10-03T11:18:08.137'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97619'
references:
  - url: 'https://git.kernel.org/stable/c/055d43a1233edbd80e558889258105ce63051bcd'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/696459029f3b65c070c91b729478475582f1dcdf'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/796aa0547557e63338657ed1c487906f9fac4c73'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cc580cee4dfa2ec9099c30ecbd4d804cbb996432'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97619.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-97619'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2541309'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-97619'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97619'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97619.mbox
  - url: 'https://git.kernel.org/stable/c/ed1cead97afb9c398bd7ab344a3c1ee34ab73af9'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00206
epssPercentile: 0.10591
cvssSource: vendor
ingestedAt: '2026-09-25T11:06:38.897Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

io_uring/rw: end write accounting from ->ki_complete

Commit b000145e9907 moved both the fsnotify calls and the write
accounting out of the kiocb completion handler and into the
io_req_rw_complete() task_work. However, only the fsnotify part actually
needed to move as it may sleep. Ending the write accounting is just a
percpu_up_read() on the superblock writers sem.

Deferring it is a problem, because it makes dropping SB_FREEZE_WRITE
protection depend on the ring owner getting to running task_work. But
the task may be blocked in freeze_super(), causing it to never get to
that:

  task                             io-wq worker
  --------------------------------------------------------------
  io_write()
    io_kiocb_start_write()         (takes sb_writers, hidden from
                                    lockdep by __sb_writers_release)
    write_iter() -> -EIOCBQUEUED
  ioctl(FS_IOC_SHUTDOWN)
    bdev_freeze()
      freeze_super()
        percpu_down_write()        <- waits for the reader above
                                   io_write()
                                     kiocb_start_write()
                                       percpu_down_read()  <- queued
                                                              behind the
                                                              writer
  <bio completes>
    io_complete_rw()
      queues io_req_rw_complete()  <- never runs, task is in D state

End the write from io_complete_rw() instead, and leave only the fsnotify
calls in task_work.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-10-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97619.json)