CVE-2026-99262: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-99262 is a race condition vulnerability in the Linux kernel's io_uring subsystem, specifically in the timeout cancellation logic when IORING_OP_TIMEOUT requests are submitted asynchronously via io-wq (using IOSQE_ASYNC). The flaw allows a cancellation signal (IO_WQ_WORK_CANCEL) to be missed if it is set between the initial flag check in io_wq_submit_work() and the point where the timeout is added to ->timeout_list, causing the timeout to run to completion despite a cancellation request. Affected versions include Linux kernel 5.6 and later, up to (but not including) the fixed stable releases. The vulnerability was published on November 3, 2026, with patches available on the same date. The EPSS score is 0.0, and the CVSS category estimate is Medium (GitHub Advisory, EUVD).

The root cause is a time-of-check/time-of-use (TOCTOU) race condition (CWE-362) in the io_uring timeout handling path. io_wq_submit_work() checks IO_WQ_WORK_CANCEL once before issuing the request; if io_async_cancel_one() sets the flag and io_timeout_cancel() searches ->timeout_list concurrently (finding nothing, returning -ENOENT), the worker proceeds to call io_timeout(), adds the request to ->timeout_list, and starts the hrtimer — with no subsequent check of the cancel flag. The fix requires checking the cancel flag under ->timeout_lock (the same lock used by the search path), ensuring mutual exclusion: if the search arrives first, the flag is visible; if the flag is set first, the subsequent search finds the request on the list and cancels it correctly. This is a local, kernel-level vulnerability requiring the ability to submit io_uring operations (GitHub Advisory).

Successful exploitation causes a Denial of Service (DoS) condition: a local user can force an IORING_OP_TIMEOUT to execute to completion even after a cancellation has been issued. The most significant consequence is that an exiting task can become stuck for the full duration of the uncancelled timeout, preventing normal process termination. There is no evidence of confidentiality or integrity impact; the vulnerability is limited to availability, affecting the local system only with no known path to lateral movement or data exfiltration (GitHub Advisory, EUVD).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the publication date. The vulnerability requires local access and the ability to submit io_uring operations, significantly limiting the attack surface. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, EUVD).

Apply the upstream Linux kernel patches that address the io_uring timeout cancellation race condition by checking IO_WQ_WORK_CANCEL under ->timeout_lock. Fixed versions by stable branch are: 6.1.191 (6.1.x), 6.6.161 (6.6.x), 6.12.115 (6.12.x), 6.18.60 (6.18.x), and 7.2.14 (7.2.x). As a workaround where patching is not immediately possible, consider restricting unprivileged access to io_uring via sysctl kernel.io_uring_disabled=1 (if supported by your kernel configuration) or limiting io_uring usage to trusted workloads only (GitHub Advisory, Kernel Patches).