--- x/io_uring/io_uring.c
+++ y/io_uring/io_uring.c
@@ -1299,8 +1299,12 @@ void __io_req_task_work_add(struct io_ki
 	if (ctx->flags & IORING_SETUP_TASKRUN_FLAG)
 		atomic_or(IORING_SQ_TASKRUN, &ctx->rings->sq_flags);
 
+	if (req->file)
+		get_file(req->file);
 	if (likely(!task_work_add(req->task, &tctx->task_work, ctx->notify_method)))
 		return;
+	if (req->file)
+		fput(req->file);
 
 	io_fallback_tw(tctx);
 }
--- x/io_uring/poll.c
+++ y/io_uring/poll.c
@@ -325,6 +325,8 @@ static void io_poll_task_func(struct io_
 	int ret;
 
 	ret = io_poll_check_events(req, locked);
+	if (req->file)
+		fput(req->file);
 	if (ret == IOU_POLL_NO_ACTION)
 		return;
 	io_poll_remove_entries(req);