Race Condition Affecting openshift/ose-rhel-coreos-9 package, versions *
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RHEL8-OPENSHIFTOSERHELCOREOS9-22344063
- published8 Nov 2026
- disclosed2 Nov 2026
Introduced: 2 Nov 2026
NewCVE-2026-99228 (opens in a new tab)How to fix?
There is no fixed version for RHEL:8 openshift/ose-rhel-coreos-9.
NVD Description
Note: Versions mentioned in the description apply only to the upstream openshift/ose-rhel-coreos-9 package and not the openshift/ose-rhel-coreos-9 package as distributed by RHEL.
See How to fix? for RHEL:8 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
io_uring/io-wq: don't lose the signal that ends work
When a thread exits, only its tracked requests are cancelled. Then its io-wq is torn down. io_wq_exit_workers() signals every worker, to get it out of an interruptible sleep, and waits for all of them to exit. Before they do, they go through the work that is left. Unbounded work is cancelled. Bounded work is run, as it is expected to end by itself.
Not all of it does. An open has no file yet, so it counts as bounded, and the open of a FIFO waits for the other end. That is what the signal is for. But the workers are signalled once, and a worker that hasn't started the work by then loses the signal:
io_wq_exit_workers() io_worker_handle_work() io_wq_worker_wake() set TIF_NOTIFY_SIGNAL io_assign_current_work() io_run_task_work() clear TIF_NOTIFY_SIGNAL io_wq_submit_work() fifo_open() wait_for_partner() wait_for_completion_timeout()
The thread never gets out of do_exit():
IORING_OP_OPENAT of a FIFO without a writer, IOSQE_ASYNC exit of the thread that has submitted it
hangs in more than 9 of 10 attempts (4 CPUs, KVM), until the process is killed.
Set TIF_NOTIFY_SIGNAL for bounded work that is started with IO_WQ_BIT_EXIT set. The bit is set before the workers are signalled, and it is tested after the flag has been cleared, with clear_notify_signal() providing the barrier. So either the flag stays, or the bit is seen.
Work that is started while the io-wq exits is treated like work that is being run at that time: it isn't interrupted unless it waits interruptibly.
References
- https://access.redhat.com/security/cve/CVE-2026-99228
- https://git.kernel.org/stable/c/08c42055b8f9a5d29236d34ad4bce08828239fe1
- https://git.kernel.org/stable/c/62996803c1b5f18176de255db4c843021f2d19c8
- https://git.kernel.org/stable/c/7309fea05a3d66af9746843c43fef14c10b8141e
- https://git.kernel.org/stable/c/ddccc60f036b309430cf130d48aafed94ef7355a
- https://git.kernel.org/stable/c/fdb771015c1e13677b57a4015f0c938748f13781
- https://git.kernel.org/stable/c/63c103279a95e82280092f2f4232e91e8117a252
- https://git.kernel.org/stable/c/7df9a3b5eda51c512d3dd138e3b7daa525071757