Live › vulnerability › CVE-2026-99267
The Linux kernel's io_uring busy-poll tracking computes its 60-second timeout with the wrong unit, so stale NAPI IDs are never dropped. Every network ID a ring has ever used keeps being polled on each wait, which wastes CPU and can degrade the system.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 12:20 UTC. All times on this page are UTC.
Systems running a Linux kernel that uses io_uring with NAPI busy polling enabled are affected; the sources do not say which kernel versions. Systems that do not use io_uring NAPI busy polling are likely not affected, but the sources do not confirm this.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
io_uring/napi: make stale entries time out after 60s
With dynamic tracking a NAPI id that hasn't been seen for a minute is meant to be dropped from the list the ring busy polls. The timeout is added to jiffies, but it is defined as 60 * SEC_CONVERSION, and SEC_CONVERSION isn't the number of jiffies in a second. It is the internal factor of __timespec64_to_jiffies(), HZ scaled up by SEC_JIFFIE_SC bits. For HZ=1000 that is 1000 << 22, which puts the timeout at about eight years. On 32-bit the multiplication overflows.
So entries are never removed, and every id that a socket of the ring ever had keeps being polled on each wait.
This page as .md · .json · in your agent: get_signal("CVE-2026-99267")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.