CVE-2026-99267: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-99267 is a Denial of Service vulnerability in the Linux kernel's io_uring/napi subsystem caused by an incorrect timeout calculation for stale NAPI busy-poll entries. The bug was introduced with Linux kernel 6.9 (starting from commit 8d0c12a80cdeb80d5e0510e96d38fe551ed8e9b5) and disclosed on November 3, 2026. The flaw causes stale NAPI IDs to never be evicted from the busy-poll list, resulting in unbounded accumulation and continuous unnecessary polling. Patched versions include 6.12.115, 6.18.60, and 7.2.14. The EPSS score is 0.0 and the CVSS base score has not been formally assigned (estimated Medium severity) (GitHub Advisory, Feedly).

The root cause is an arithmetic error in the io_uring/napi subsystem where the 60-second timeout for stale NAPI entries is computed using 60 * SEC_CONVERSION instead of 60 * HZ. SEC_CONVERSION is an internal scaling factor used by __timespec64_to_jiffies() — specifically, HZ shifted left by SEC_JIFFIE_SC bits — not the number of jiffies per second. For HZ=1000, this yields a timeout of approximately eight years rather than 60 seconds. On 32-bit systems, the multiplication overflows entirely. As a result, stale NAPI IDs accumulated from past socket operations are never removed from the ring's busy-poll list, and every socket ID the ring has ever seen continues to be polled on each wait cycle. No CWE classification has been formally assigned, but the issue is consistent with CWE-190 (Integer Overflow or Wraparound) on 32-bit systems and CWE-682 (Incorrect Calculation) more broadly (GitHub Advisory).

The primary impact is a local Denial of Service: any local user able to create io_uring instances with socket operations can trigger unbounded accumulation of stale NAPI poll entries, causing continuous unnecessary CPU polling on all previously-seen socket IDs. This degrades system performance and wastes CPU resources proportionally to the number of unique socket IDs ever associated with the ring. There is no evidence of confidentiality or integrity impact; the vulnerability does not enable privilege escalation or data exfiltration (Feedly, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The vulnerability requires local access to create io_uring instances, limiting the attack surface to authenticated local users. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly, GitHub Advisory).

Apply the available kernel patches, which correct the timeout calculation to use HZ instead of SEC_CONVERSION. Fixed commits are available for multiple stable branches: 3fe820cf35f83534eab72ea73f1a83cfd3cd8079, 18c373f446068972788158c8c7de6e849b04ed98, and 981621d6eadcd232d4ea748aaeb046337f10d3c1. Patched stable releases include Linux 6.12.115, 6.18.60, and 7.2.14. As a temporary workaround where patching is not immediately possible, limiting or disabling the use of io_uring with NAPI dynamic tracking in performance-sensitive environments can reduce impact (GitHub Advisory, Kernel Patch 1, Kernel Patch 2, Kernel Patch 3).