Linux kernel: io_uring cancel reference wrap mitigated
CVE-2026-99227 Published on November 2, 2026
io_uring/waitid: prevent cancel reference wrap
In the Linux kernel, the following vulnerability has been resolved:
io_uring/waitid: prevent cancel reference wrap
io_waitid packs the cancellation state into bit 31 of ->refs and uses
bits 30:0 as a 31-bit reference counter:
#define IO_WAITID_CANCEL_FLAG BIT(31)
#define IO_WAITID_REF_MASK GENMASK(30, 0)
__io_waitid_cancel() marks a request canceled, then increments the low
bits of ->refs to claim completion ownership. When another path owns the
request, the increment remains even though cancellation returns false.
The request remains discoverable by cancellation, so repeated failed
attempts can wrap the 31-bit reference field to zero. A later
cancellation can claim ownership and complete the request a second time.
Use atomic_fetch_or() when setting the cancel flag and inspect the old
flag value. The first cancel attempt continues to the existing ownership
increment, preserving its wake and issuer handoff semantics. Later
attempts see the cancel flag and return without incrementing the
reference field.
This makes repeated failed cancellation attempts idempotent while
leaving the first-cancel state transitions unchanged.
Products Associated with CVE-2026-99227
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version f31ecf671ddc498f20219453395794ff2383e06b and below 20b67288574c7c3df6b8ea7ed3b7af90a868006f is affected.
- Version f31ecf671ddc498f20219453395794ff2383e06b and below 5bfeee1774791602a0d53eb717f00f172127a017 is affected.
- Version f31ecf671ddc498f20219453395794ff2383e06b and below 857aa2012b91cad6fdef54a4b6c632d9d0b6e64f is affected.
- Version f31ecf671ddc498f20219453395794ff2383e06b and below 22fb4a4518e305164c7f203608287564de292f34 is affected.
- Version 6.7 is affected.
- Before 6.7 is unaffected.
- Version 6.12.115, <= 6.12.* is unaffected.
- Version 6.18.60, <= 6.18.* is unaffected.
- Version 7.2.14, <= 7.2.* is unaffected.
- Version 7.3.1, <= 7.3.* is unaffected.