Linux Kernel: io_uring NAPI stale id timeout miscalc causes endless polling
CVE-2026-99267 Published on November 3, 2026
io_uring/napi: make stale entries time out after 60s
In the Linux kernel, the following vulnerability has been resolved:
io_uring/napi: make stale entries time out after 60s
With dynamic tracking a NAPI id that hasn't been seen for a minute is
meant to be dropped from the list the ring busy polls. The timeout is
added to jiffies, but it is defined as 60 * SEC_CONVERSION, and
SEC_CONVERSION isn't the number of jiffies in a second. It is the
internal factor of __timespec64_to_jiffies(), HZ scaled up by
SEC_JIFFIE_SC bits. For HZ=1000 that is 1000 << 22, which puts the
timeout at about eight years. On 32-bit the multiplication overflows.
So entries are never removed, and every id that a socket of the ring
ever had keeps being polled on each wait.
Products Associated with CVE-2026-99267
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 8d0c12a80cdeb80d5e0510e96d38fe551ed8e9b5 and below 3fe820cf35f83534eab72ea73f1a83cfd3cd8079 is affected.
- Version 8d0c12a80cdeb80d5e0510e96d38fe551ed8e9b5 and below 18c373f446068972788158c8c7de6e849b04ed98 is affected.
- Version 8d0c12a80cdeb80d5e0510e96d38fe551ed8e9b5 and below 981621d6eadcd232d4ea748aaeb046337f10d3c1 is affected.
- Version 6.9 is affected.
- Before 6.9 is unaffected.
- Version 6.12.115, <= 6.12.* is unaffected.
- Version 6.18.60, <= 6.18.* is unaffected.
- Version 7.2.14, <= 7.2.* is unaffected.