CVE-2026-99267
Description
In the Linux kernel, the following vulnerability has been resolved: io_uring/napi: make stale entries time out after 60s With dynamic tracking a NAPI id that hasn't been seen for a minute is meant to be dropped from the list the ring busy polls. The timeout is added to jiffies, but it is defined as 60 * SEC_CONVERSION, and SEC_CONVERSION isn't the number of jiffies in a second. It is the internal factor of __timespec64_to_jiffies(), HZ scaled up by SEC_JIFFIE_SC bits. For HZ=1000 that is 1000 << 22, which puts the timeout at about eight years. On 32-bit the multiplication overflows. So entries are never removed, and every id that a socket of the ring ever had keeps being polled on each wait.
How to fix
- Linux Linux3fe820cf35f83534eab72ea73f1a83cfd3cd8079, 18c373f446068972788158c8c7de6e849b04ed98, 981621d6eadcd232d4ea748aaeb046337f10d3c1, 9c151648780d89e5446e5f89f3fa2e416c3bb911 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 8d0c12a80cdeb80d5e0510e96d38fe551ed8e9b5 ≤ v < 3fe820cf35f83534eab72ea73f1a83cfd3cd8079, 8d0c12a80cdeb80d5e0510e96d38fe551ed8e9b5 ≤ v < 18c373f446068972788158c8c7de6e849b04ed98, 8d0c12a80cdeb80d5e0510e96d38fe551ed8e9b5 ≤ v < 981621d6eadcd232d4ea748aaeb046337f10d3c1, 8d0c12a80cdeb80d5e0510e96d38fe551ed8e9b5 ≤ v < 9c151648780d89e5446e5f89f3fa2e416c3bb911, 6.9 | 3fe820cf35f83534eab72ea73f1a83cfd3cd8079, 18c373f446068972788158c8c7de6e849b04ed98, 981621d6eadcd232d4ea748aaeb046337f10d3c1, 9c151648780d89e5446e5f89f3fa2e416c3bb911 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.