# CVE-2026-99267: Linux kernel io_uring NAPI timeout calculation integer overflow

Source: https://junglewise.ai/threats/cve-2026-99267-in-the-linux-kernel-the-following-vulnerability-has-been-resolved  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-99267 · Severity: info · Published 2026-11-03

The Linux kernel's io_uring subsystem contains a bug in how it calculates timeouts for network polling entries. Due to incorrect constant usage, timeout values are computed as approximately eight years instead of 60 seconds, causing stale entries to accumulate in memory indefinitely. This can lead to excessive CPU usage during I/O operations as the kernel polls obsolete network interfaces.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux).

## Quick answers

**Is CVE-2026-99267 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-99267 being exploited in the wild.

**How severe is CVE-2026-99267?** Informational severity, published 3 November 2026.

**Which products and versions are affected?** Linux Kernel Before fix commit 9c151648780d89e5446e5f89f3fa2e416c3bb911.

**Is there a fix for CVE-2026-99267?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-99267 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-99267?** Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The io_uring NAPI busy-polling code uses SEC_CONVERSION (an internal factor for timespec conversion equal to HZ << 22, approximately 4 billion for HZ=1000) instead of HZ to calculate a 60-second timeout. This causes the timeout to be set to roughly 60 × 4 billion = 240 billion jiffies (~8 years), and overflows on 32-bit systems. Consequently, stale NAPI entries are never removed from the polling list, causing memory bloat and persistent unnecessary polling on previously-used network interfaces.

## Affected products

- Linux Linux kernel Before fix commit 9c151648780d89e5446e5f89f3fa2e416c3bb911

## Timeline

- 2026-11-03: disclosed

## References

- [https://git.kernel.org/stable/c/18c373f446068972788158c8c7de6e849b04ed98](https://git.kernel.org/stable/c/18c373f446068972788158c8c7de6e849b04ed98)
- [https://git.kernel.org/stable/c/3fe820cf35f83534eab72ea73f1a83cfd3cd8079](https://git.kernel.org/stable/c/3fe820cf35f83534eab72ea73f1a83cfd3cd8079)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel shared-frag flag loss in skb_zerocopy](https://junglewise.ai/threats/cve-2026-99284-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel netfilter conntrack TCP RST timeout handling](https://junglewise.ai/threats/cve-2026-99283-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)