---
id: "CVE-2026-99263"
kind: "vulnerability"
aliases: ["CVE-2026-99263"]
title: "Linux kernel io_uring: poll retry wakeups can be lost, stalling requests"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["io_uring", "kernel", "linux", "runtime", "self-hosted"]
not_affected_if: ["io_uring-disabled", "non-linux"]
published_at: "2026-11-03T12:17:33+00:00"
first_seen_at: "2026-11-03T12:20:40+00:00"
updated_at: "2026-11-03T12:22:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99263", "first_seen_at": "2026-11-03T12:20:40+00:00"}]
---

# Linux kernel io_uring: poll retry wakeups can be lost, stalling requests

In the Linux kernel's io_uring poll path, a wakeup that arrives at the wrong moment can be lost, leaving a request stalled until an unrelated wakeup occurs. The sources describe a stall (denial of service style impact), not code execution or data access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `uname -r` to see the running kernel version
- Check whether io_uring is in use on the host (for example, `cat /proc/sys/kernel/io_uring_disabled` on kernels that expose it)

## Timeline

- 2026-11-03T12:20:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99263

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

io_uring/poll: avoid retry wakeup loss when dropping ownership

If a wakeup sets IO_POLL_RETRY_FLAG between the owning task consuming
the existing instance of IO_POLL_RETRY_FLAG and the loop check
of io_poll_check_events(), then we stall on processing the request
until an unrelated wakeup comes along.

Using atomic_cmpxchg instead of atomic_sub_return to guarantee both the
count v and poll_refs are 0 and no wake-ups are missed.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_