Linux kernel io_uring poll retry wakeup loss fixed
CVE-2026-99263 Published on November 3, 2026
io_uring/poll: avoid retry wakeup loss when dropping ownership
In the Linux kernel, the following vulnerability has been resolved:
io_uring/poll: avoid retry wakeup loss when dropping ownership
If a wakeup sets IO_POLL_RETRY_FLAG between the owning task consuming
the existing instance of IO_POLL_RETRY_FLAG and the loop check
of io_poll_check_events(), then we stall on processing the request
until an unrelated wakeup comes along.
Using atomic_cmpxchg instead of atomic_sub_return to guarantee both the
count v and poll_refs are 0 and no wake-ups are missed.
Products Associated with CVE-2026-99263
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version a26a35e9019fd70bf3cf647dcfdae87abc7bacea and below d1f6850086ac6f8b0fa44fb19aa2a468c73ee071 is affected.
- Version a26a35e9019fd70bf3cf647dcfdae87abc7bacea and below 41fae2e9e1fa3bee86aee0a25ba90e59ce5024bf is affected.
- Version a26a35e9019fd70bf3cf647dcfdae87abc7bacea and below 4ef685b8505615729d75c875f52822238bf76ca6 is affected.
- Version a26a35e9019fd70bf3cf647dcfdae87abc7bacea and below afa407c02f3aa0fd872f86c9bf1b34502e0fa8f0 is affected.
- Version a26a35e9019fd70bf3cf647dcfdae87abc7bacea and below eb2a50d8235e4580fea9aa20f3fbe1a002c38cb1 is affected.
- Version a26a35e9019fd70bf3cf647dcfdae87abc7bacea and below 521e8a65e9b45532295ba1082ef12be6e80c173b is affected.
- Version 4b702b7d11ce1b9d26fc6d7c5a7ef4ac1d455048 is affected.
- Version bc4e6ee16778149811333a969a7a893d4cc110c5 is affected.
- Version 5.15.82 and below 5.16 is affected.
- Version 6.0.11 and below 6.1 is affected.
- Version 6.1 is affected.
- Before 6.1 is unaffected.
- Version 6.1.191, <= 6.1.* is unaffected.
- Version 6.6.161, <= 6.6.* is unaffected.
- Version 6.12.115, <= 6.12.* is unaffected.
- Version 6.18.60, <= 6.18.* is unaffected.
- Version 7.2.14, <= 7.2.* is unaffected.
- Version 7.3.1, <= 7.3.* is unaffected.