{"id":"CVE-2026-99227","kind":"vulnerability","aliases":["CVE-2026-99227"],"related":[],"title":"Linux kernel: repeated io_uring waitid cancellation can complete a request twice","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/waitid: prevent cancel reference wrap\n\nio_waitid packs the cancellation state into bit 31 of ->refs and uses\nbits 30:0 as a 31-bit reference counter:\n\n  #define IO_WAITID_CANCEL_FLAG BIT(31)\n  #define IO_WAITID_REF_MASK    GENMASK(30, 0)\n\n__io_waitid_cancel() marks a request canceled, then increments the low\nbits of ->refs to claim completion ownership. When another path owns the\nrequest, the increment remains even though cancellation returns false.\nThe request remains discoverable by cancellation, so repeated failed\nattempts can wrap the 31-bit reference field to zero. A later\ncancellation can claim ownership and complete the request a second time.\n\nUse atomic_fetch_or() when setting the cancel flag and inspect the old\nflag value. The first cancel attempt continues to the existing ownership\nincrement, preserving its wake and issuer handoff semantics. Later\nattempts see the cancel flag and return without incrementing the\nreference field.\n\nThis makes repeated failed cancellation attempts idempotent while\nleaving the first-cancel state transitions unchanged.","summary":"A bug in the Linux kernel's io_uring waitid code lets repeated failed cancellation attempts wrap an internal reference counter to zero. A later cancellation can then complete the same request a second time, which can corrupt kernel state.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["io_uring","linux-kernel","runtime","self-hosted"],"not_affected_if":["io_uring-disabled"],"how_to_check":"- Run uname -r and check your distro's kernel changelog/security tracker for CVE-2026-99227 or commit 98787d3fa4e9.\n- Affected code is anything with IORING_OP_WAITID (introduced by commit f31ecf671ddc); kernels without it are not affected.\n- cat /proc/sys/kernel/io_uring_disabled: 0 allows all users, 1 restricts to privileged/group, 2 disables io_uring. Setting 2 would block the path (sysctl semantics, not confirmed on the vendor page).","fix":"Upstream fix is commit 98787d3fa4e99564d2b2bc21255b21f670c450d0 (io_uring/waitid: prevent cancel reference wrap). Fixed stable kernel versions not yet published in the sources read; install your distro kernel update that lists CVE-2026-99227 or contains this commit.","status":"open","published_at":"2026-11-02T16:17:47+00:00","first_seen_at":"2026-11-02T16:24:05+00:00","triaged_at":"2026-11-02T16:26:36+00:00","updated_at":"2026-11-02T16:29:33+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-02T16:26:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: repeated io_uring waitid cancellation can complete a request twice","impact":"high","summary":"A bug in the Linux kernel's io_uring waitid code lets repeated failed cancellation attempts wrap an internal reference counter to zero. A later cancellation can then complete the same request a second time, which can corrupt kernel state.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux-kernel","io_uring","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"kernel memory corruption from a double request completion, possibly privilege escalation","analyst_note":"Confirm fixed kernel versions and whether unprivileged users can reach io_uring waitid, using the NVD entry and the kernel stable commit.","how_to_check":"- Check the running kernel version with `uname -r` and compare it against the fixed versions in the kernel's stable release notes.\n- Check whether io_uring is in use, for example with `cat /proc/sys/kernel/io_uring_disabled` (unknown whether this reflects waitid use).","plain_action":"","needs_analyst":true,"not_affected_if":["io_uring-disabled"],"who_is_affected":"Systems running a Linux kernel with io_uring enabled that use the waitid operation. The sources do not state which kernel versions are fixed or whether a default configuration is exposed. Systems with io_uring disabled are likely unaffected, but the sources do not confirm this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000731,"input_tokens":4446,"output_tokens":573,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm fixed kernel versions and whether unprivileged users can reach io_uring waitid, using the NVD entry and the kernel stable commit.","search":"'-2026':14A,17A '-99227':15A,18A '0':99C,120C '30':98C,119C '31':92C,102C,112C,166C 'anoth':140C 'atom':186C 'attempt':43B,162C,203C,218C,235C 'bit':91C,97C,103C,111C,132C,167C 'bug':29B 'cancel':7A,42B,53B,81C,88C,109C,123C,127C,150C,158C,174C,192C,202C,221C,234C,242C 'claim':136C,176C 'code':38B 'complet':9A,56B,137C,179C 'continu':204C 'corrupt':65B 'counter':48B,105C 'cve':13A,16A 'defin':106C,113C 'discover':156C 'even':148C 'exist':207C 'fail':41B,161C,233C 'fals':152C 'fetch':187C 'field':169C,229C 'first':201C,241C 'first-cancel':240C 'flag':110C,193C,198C,222C 'follow':73C 'genmask':118C 'handoff':215C 'host':27B 'idempot':236C 'increment':129C,146C,209C,226C 'inspect':195C 'intern':46B 'io':4A,19B,35B,78C,84C,107C,114C,121C 'issuer':214C 'kernel':2A,23B,33B,66B,71C 'later':52B,173C,217C 'leav':238C 'let':39B 'linux':1A,22B,32B,70C 'linux-kernel':21B 'low':131C 'make':231C 'mark':124C 'mask':117C 'old':197C 'own':142C 'ownership':138C,177C,208C 'pack':86C 'path':141C 'preserv':210C 'prevent':80C 'ref':94C,116C,134C 'refer':47B,82C,104C,168C,228C 'remain':147C,155C 'repeat':3A,40B,160C,232C 'request':11A,59B,126C,144C,154C,181C 'resolv':77C 'return':151C,224C 'runtim':24B 'second':61B,183C 'see':219C 'self':26B 'self-host':25B 'semant':216C 'set':190C 'state':67B,89C,243C 'though':149C 'time':62B,184C 'transit':244C 'twice':12A 'unchang':245C 'ure':5A,20B,36B 'uring/waitid':79C 'use':96C,185C 'valu':199C 'vulner':74C 'waitid':6A,37B,85C,108C,115C,122C 'wake':212C 'without':225C 'wrap':44B,83C,164C 'zero':50B,171C","nicknames":[],"mitigations":[],"who_affected":"Linux hosts running a kernel that contains io_uring waitid support and where local users or containers can create io_uring rings. The bug is local (CVSS vector AV:L, PR:L): an attacker needs to run code on the machine. Multi-tenant hosts, shared build runners and container hosts matter most; hosts with io_uring disabled can skip it. Fixed kernel versions are not yet confirmed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","iouring","linuxkernel","runtime","selfhosted"],"first_public_at":"2026-11-02T16:17:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99227","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99227","severity":null,"published_at":"2026-11-02T16:17:47+00:00","modified_at":"2026-11-02T16:17:47+00:00","first_seen_at":"2026-11-02T16:24:05+00:00","fetched_at":"2026-11-02T16:24:05+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-99227:1395","url":null,"severity":null,"published_at":"2026-11-02T16:29:33+00:00","modified_at":"2026-11-02T16:29:33+00:00","first_seen_at":"2026-11-02T16:29:33+00:00","fetched_at":"2026-11-02T16:29:33+00:00","note":"Found upstream patch (Junyeong Lee, 2026-10-19) applied by Jens Axboe as commit 98787d3fa4e99564d2b2bc21255b21f670c450d0 in the io_uring tree; Fixes f31ecf671ddc (IORING_OP_WAITID support), Cc stable. No stable release numbers read yet; NVD page returned no text. Nothing verified."}],"documents":[{"id":52866,"url":"https://lkml.iu.edu/2610.2/08336.html","title":"Re: [PATCH] io_uring/waitid: prevent cancel reference wrap (Jens Axboe, applied)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":52867,"url":"https://lkml.iu.edu/2610.2/07793.html","title":"[PATCH] io_uring/waitid: prevent cancel reference wrap (Junyeong Lee)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}