CVE-2026-99263: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-99263 is a race condition vulnerability in the Linux kernel's io_uring poll subsystem, specifically in the poll event handling path. The flaw causes io_uring poll requests to stall indefinitely when a wakeup sets IO_POLL_RETRY_FLAG between the owning task consuming an existing instance of that flag and the loop check in io_poll_check_events(). Affected versions include Linux kernel 5.15.82 up to (but not including) 5.16, 6.0.11 up to (but not including) 6.1, and kernel 6.1. The vulnerability was published on November 3, 2026, and a patch is available. The CVSS base score is listed as 0.0 (no severity rating assigned at time of publication), with an estimated medium severity (GitHub Advisory, Feedly).

The root cause is a concurrency/race condition (CWE-362) in the io_uring poll ownership drop logic. When the owning task reads and clears IO_POLL_RETRY_FLAG and then checks the loop condition in io_poll_check_events(), a concurrent wakeup can set IO_POLL_RETRY_FLAG in the window between those two operations, causing the flag to be silently lost. The fix replaces atomic_sub_return with atomic_cmpxchg to atomically verify that both the reference count (v) and poll_refs are zero before dropping ownership, ensuring no wakeups are missed during the transition. This vulnerability requires local access and the ability to submit io_uring poll operations (GitHub Advisory, Kernel Stable).

A local user with the ability to use io_uring operations can trigger this race condition to cause io_uring poll requests to stall indefinitely, preventing those requests from completing until an unrelated system event triggers a wakeup. The primary impact is a Denial of Service (DoS) affecting availability of io_uring-dependent workloads on the system. There is no evidence of confidentiality or integrity impact, and the vulnerability does not enable privilege escalation or lateral movement (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of publication. The vulnerability requires local access to the system and the ability to submit io_uring operations, limiting the attack surface. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly, GitHub Advisory).

Update the Linux kernel to a patched version that incorporates the fix using atomic_cmpxchg instead of atomic_sub_return in the io_uring poll ownership drop path. Patched versions include 6.1.191, 6.6.161, 6.12.115, 6.18.60, 7.2.14, and 7.3.1. If immediate upgrade is not possible, consider restricting unprivileged access to io_uring via kernel parameters (e.g., kernel.io_uring_disabled=1 or kernel.io_uring_group) as a temporary mitigation (GitHub Advisory, Kernel Stable).