{"id":"CVE-2026-99263","kind":"vulnerability","aliases":["CVE-2026-99263"],"related":[],"title":"Linux kernel io_uring: poll retry wakeups can be lost, stalling requests","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/poll: avoid retry wakeup loss when dropping ownership\n\nIf a wakeup sets IO_POLL_RETRY_FLAG between the owning task consuming\nthe existing instance of IO_POLL_RETRY_FLAG and the loop check\nof io_poll_check_events(), then we stall on processing the request\nuntil an unrelated wakeup comes along.\n\nUsing atomic_cmpxchg instead of atomic_sub_return to guarantee both the\ncount v and poll_refs are 0 and no wake-ups are missed.","summary":"In the Linux kernel's io_uring poll path, a wakeup that arrives at the wrong moment can be lost, leaving a request stalled until an unrelated wakeup occurs. The sources describe a stall (denial of service style impact), not code execution or data access.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["io_uring","kernel","linux","runtime","self-hosted"],"not_affected_if":["io_uring-disabled","non-linux"],"how_to_check":"- `uname -r` to see the running kernel version\n- Check whether io_uring is in use on the host (for example, `cat /proc/sys/kernel/io_uring_disabled` on kernels that expose it)","fix":null,"status":"open","published_at":"2026-11-03T12:17:33+00:00","first_seen_at":"2026-11-03T12:20:40+00:00","triaged_at":"2026-11-03T12:22:43+00:00","updated_at":"2026-11-03T12:22:43+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-03T12:22:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel io_uring: poll retry wakeups can be lost, stalling requests","impact":"low","summary":"In the Linux kernel's io_uring poll path, a wakeup that arrives at the wrong moment can be lost, leaving a request stalled until an unrelated wakeup occurs. The sources describe a stall (denial of service style impact), not code execution or data access.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux","kernel","io_uring","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Requests stall indefinitely until an unrelated wakeup arrives","analyst_note":"Check the NVD entry and the upstream kernel stable commits for affected and fixed kernel version ranges.","how_to_check":"- `uname -r` to see the running kernel version\n- Check whether io_uring is in use on the host (for example, `cat /proc/sys/kernel/io_uring_disabled` on kernels that expose it)","plain_action":"","needs_analyst":true,"not_affected_if":["io_uring-disabled","non-linux"],"who_is_affected":"Systems running a Linux kernel with io_uring poll operations, typically servers running io_uring-based network or file I/O. The sources do not state the affected kernel version ranges. Hosts without io_uring in use are unlikely to be exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000692,"input_tokens":4224,"output_tokens":539,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-99263':15A,18A '0':152C 'access':71B 'along':133C 'arriv':39B 'atom':135C,139C 'avoid':84C 'check':115C,119C 'cmpxchg':136C 'code':67B 'come':132C 'consum':103C 'count':146C 'cve':13A,16A 'data':70B 'denial':61B 'describ':58B 'drop':89C 'event':120C 'execut':68B 'exist':105C 'flag':98C,111C 'follow':77C 'guarante':143C 'host':26B 'impact':65B 'instanc':106C 'instead':137C 'io':3A,19B,32B,82C,95C,108C,117C 'kernel':2A,21B,30B,75C 'leav':47B 'linux':1A,22B,29B,74C 'loop':114C 'loss':87C 'lost':10A,46B 'miss':159C 'moment':43B 'occur':55B 'own':101C 'ownership':90C 'path':35B 'poll':5A,34B,96C,109C,118C,149C 'process':125C 'ref':150C 'request':12A,49B,127C 'resolv':81C 'retri':6A,85C,97C,110C 'return':141C 'runtim':23B 'self':25B 'self-host':24B 'servic':63B 'set':94C 'sourc':57B 'stall':11A,50B,60B,123C 'style':64B 'sub':140C 'task':102C 'unrel':53B,130C 'up':157C 'ure':4A,20B,33B 'uring/poll':83C 'use':134C 'v':147C 'vulner':78C 'wake':156C 'wake-up':155C 'wakeup':7A,37B,54B,86C,93C,131C 'wrong':42B","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with io_uring poll operations, typically servers running io_uring-based network or file I/O. The sources do not state the affected kernel version ranges. Hosts without io_uring in use are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["iouring","kernel","linux","runtime","selfhosted","unknown"],"first_public_at":"2026-11-03T12:17:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99263","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99263","severity":null,"published_at":"2026-11-03T12:17:33+00:00","modified_at":"2026-11-03T12:17:33+00:00","first_seen_at":"2026-11-03T12:20:40+00:00","fetched_at":"2026-11-03T12:20:40+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}