CVE-2026-99263

What it actually does

Race condition in io_uring poll handling where a wakeup can set IO_POLL_RETRY_FLAG after the owning task clears the flag but before the loop check in io_poll_check_events, causing missed wakeups and stalled request processing until an unrelated wakeup occurs; resolved by switching to atomic_cmpxchg to atomically verify count and refs are zero.

Why it matters to the business

Linux systems using io_uring for high-performance asynchronous I/O may experience intermittent stalls in poll-based operations, reducing application throughput and increasing latency for workloads dependent on timely event delivery.

How an attack unfolds

An attacker with local access triggers concurrent poll wakeups and ownership transitions on io_uring requests to set the retry flag in the narrow window between flag consumption and the subsequent check, forcing the kernel to miss the wakeup and leave the request stalled.

How to fix it

Apply the upstream kernel patch that replaces atomic_sub_return with atomic_cmpxchg in the io_uring poll path; rebuild and deploy the fixed kernel across affected systems.

How to confirm the fix worked

Inspect the io_uring/poll source for the atomic_cmpxchg usage guarding poll_refs and count; confirm no remaining calls to atomic_sub_return in the retry-flag handling path and run stress tests exercising concurrent poll wakeups.

Typical attack path

1. Identify applications or workloads using io_uring poll operations
2. Create concurrent threads or processes that manipulate poll events and wakeups
3. Force the timing window between atomic flag consumption and io_poll_check_events loop check
4. Observe stalled request completion until an unrelated wakeup arrives

How to detect it

Review kernel traces and application logs for io_uring poll requests that remain pending without completion events; monitor for unusually long-lived poll contexts or sudden spikes in unrelated wakeup activity that unblock stalled requests.

What your security team should do

• Prioritize kernel updates containing the io_uring poll atomic fix within standard patch cycles
• Audit internal workloads for io_uring usage and evaluate fallback to older I/O interfaces if stalls are observed
• Include io_uring poll paths in future kernel regression and concurrency testing suites