Executive brief
A technical flaw was identified in the Linux kernel's io_uring subsystem, which is used for high-performance data input and output operations. Due to a programming error in how the system tracks internal references, certain cleanup tasks might not be triggered correctly when an operation is canceled. This could potentially lead to system instability or resource management issues, though it primarily affects internal kernel housekeeping.
Technical details
A vulnerability exists in the Linux kernel io_uring/poll component due to an incorrect signed comparison in io_poll_get_ownership(). The function uses atomic_read() to check if poll_refs has reached IO_POLL_REF_BIAS; however, because atomic_read() returns a signed integer, setting the IO_POLL_CANCEL_FLAG (BIT(31)) causes the value to be interpreted as negative. This results in the comparison (>= 128) failing incorrectly, preventing the necessary slowpath execution during request cancellation. The fix involves casting the atomic_read() result to an unsigned int to ensure the cancel flag is treated as a large positive value. The issue has been patched in multiple stable branches of the Linux kernel.
Affected products
- Linux Linux kernel All versions prior to the fix in io_uring/poll
Timeline
- 2026-04-12: disclosed: Initial patch authored
- 2026-06-24: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/326941b22806cbf2df1fbfe902b7908b368cce42
- https://git.kernel.org/stable/c/81bf96b0abbfa4cd47ea32e12596aed3855fb2f3
- https://git.kernel.org/stable/c/c6d191164dc81838d8dbf452a6000f68c558d1ae
- https://git.kernel.org/stable/c/cf522703d4f194991615763697ae25a3f9539763
- https://git.kernel.org/stable/c/ea0697129807d718037f618221037aa0660ee3c5
- https://git.kernel.org/stable/c/fc47043f3d9af3efa407665b47f8378ec691ba18