In the Linux kernel, the following vulnerability has been resolved: io_uring: defer eventfd signaling when queued from a wakeup handler io_req_local_work_add() signals the CQ ring eventfd inline when it is the one to push the first entry onto ->work_list. For DEFER_TASKRUN rings that add is frequently done from a waitqueue wakeup handler, where an arbitrary waitqueue lock is held. eventfd_signal_mask() only refuses to recurse when current->in_eventfd is set, but that bit is set by eventfd_signal_mask() itself. If the wake chain starts somewhere else, signal goes out inline and can feed back into epoll. Add IOU_F_TWQ_IN_WAKE, set it on the task_work add done from the three waitqueue callbacks, and use it to force io_eventfd_signal() down the existing call_rcu_hurry() deferral instead of signaling inline.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: io_uring: defer eventfd signaling when
    queued from a wakeup handler io_req_local_work_add() signals the CQ ring eventfd inline when it is the one
    to push the first entry onto ->work_list. For DEFER_TASKRUN rings that add is frequently done from a
    waitqueue wakeup handler, where an arbitrary waitqueue lock is held. eventfd_signal_mask() only refuses to
    recurse when current->in_eventfd is set, but that bit is set by eventfd_signal_mask() itself. If the wake
    chain starts somewhere else, signal goes out inline and can feed back into epoll. Add IOU_F_TWQ_IN_WAKE,
    set it on the task_work add done from the three waitqueue callbacks, and use it to force
    io_eventfd_signal() down the existing call_rcu_hurry() deferral instead of signaling inline.
    (CVE-2026-80920)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - io_uring: defer eventfd signaling when queued from a wakeup handler io_req_local_work_add() signals the CQ     ring eventfd inline when it is the one to push the first entry onto ->work_list. For DEFER_TASKRUN rings     that add is frequently done from a waitqueue wakeup handler, where an arbitrary waitqueue lock is held.
    eventfd_signal_mask() only refuses to recurse when current->in_eventfd is set, but that bit is set by     eventfd_signal_mask() itself. If the wake chain starts somewhere else, signal goes out inline and can feed     back into epoll. Add IOU_F_TWQ_IN_WAKE, set it on the task_work add done from the three waitqueue     callbacks, and use it to force io_eventfd_signal() down the existing call_rcu_hurry() deferral instead of     signaling inline. (CVE-2026-80920)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
377900	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-3402)	Nessus	Amazon Linux Local Security Checks	Local	high
376443	Ubuntu 24.04 LTS / 26.04 LTS : Linux kernel vulnerabilities (USN-8959-1)	Nessus	Ubuntu Local Security Checks	Local	high
365283	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-3187)	Nessus	Amazon Linux Local Security Checks	Local	medium
472153	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20098.0.0	Tenable Cloud Security	Google COS Security Checks	Local	high
472153	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20098.0.0	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	high
344385	Linux Distros Unpatched Vulnerability : CVE-2026-80920	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-80920

high

Tenable Plugins

high

high

medium

high

high

high