Cloudanix VulnDB

CVE-2026-99267

None

CVSS

—

EPSS

0.2%

Published

Nov 3, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A recent Linux kernel bug keeps old network tracking entries around for years instead of a minute, causing extra unnecessary work that can slow systems down over time.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Incorrect timeout constant (SEC_CONVERSION instead of HZ-scaled seconds) causes NAPI IDs in io_uring dynamic tracking to never expire (approximately eight years or integer overflow on 32-bit), leaving every previously seen socket ID permanently in the busy-poll list.

Why it matters to the business

Systems relying on io_uring NAPI polling experience gradual growth in unnecessary polling work and potential CPU overhead or latency spikes under long-lived socket workloads; the one-day-old kernel fix should be prioritized in upcoming maintenance windows.

How an attack unfolds

An attacker opens and closes many sockets associated with an io_uring ring that uses dynamic NAPI tracking; each ID remains in the poll list indefinitely, causing the kernel to waste cycles polling stale entries on every wait operation.

How to fix it

Upgrade to a Linux kernel containing the commit that replaces the erroneous 60*SEC_CONVERSION timeout with the correct jiffies value; rebuild and reboot affected hosts.

How to confirm the fix worked

Confirm kernel source contains the corrected timeout calculation (60 * HZ or equivalent) and that NAPI IDs are observed to be dropped after approximately 60 seconds of inactivity.

Typical attack path

  1. Establish io_uring ring with NAPI dynamic tracking enabled
  2. Create and close numerous sockets to populate NAPI ID list
  3. Trigger repeated ring wait operations to force repeated polling of stale entries
  4. Observe sustained CPU or latency impact from perpetual polling

How to detect it

Monitor kernel logs for repeated NAPI ID additions without corresponding removals; inspect io_uring ring state via tracing tools for growth in tracked NAPI entries beyond expected socket lifetime.

What your security team should do

  • Schedule kernel updates for all hosts using io_uring within the next maintenance cycle
  • Review production workloads for io_uring NAPI usage and measure baseline CPU during socket churn
  • Add kernel version checks to vulnerability scanning policies

The record

In the Linux kernel, the following vulnerability has been resolved: io_uring/napi: make stale entries time out after 60s With dynamic tracking a NAPI id that hasn't been seen for a minute is meant to be dropped from the list the ring busy polls. The timeout is added to jiffies, but it is defined as 60 * SEC_CONVERSION, and SEC_CONVERSION isn't the number of jiffies in a second. It is the internal factor of __timespec64_to_jiffies(), HZ scaled up by SEC_JIFFIE_SC bits. For HZ=1000 that is 1000 << 22, which puts the timeout at about eight years. On 32-bit the multiplication overflows. So entries are never removed, and every id that a socket of the ring ever had keeps being polled on each wait.

Affected packages

Ecosystem Package Introduced Fixed