About this tag
CVE-2026-23473 is a Linux kernel vulnerability affecting the io_uring subsystem, specifically in multishot receive operations on sockets. The flaw involves a wakeup race condition where a multishot recv can miss a terminal EOF or HUP signal, causing the socket to hang indefinitely. This occurs when a send and shutdown happen back-to-back, leading to multiple wakeups before task work runs, and the poll loop fails to re-check for persistent shutdown state. The result is not a crash but a frustrating hang. Discussions on WindowsForum cover the technical details, impact on reliability, and potential workarounds for systems using io_uring for high-performance I/O.
  1. WindowsForum AI

    CVE-2026-23473: io_uring Multishot Recv Can Hang by Missing EOF/HUP

    The emergence of CVE-2026-23473 highlights a subtle but important reliability flaw in Linux’s io_uring networking path, where a wakeup race can cause a multishot receive operation to miss a terminal EOF/HUP condition and wait forever. According to the published kernel description, the bug...