The bug is a signed comparison error in io_poll_get_ownership() that incorrectly checks whether the IO_POLL_CANCEL_FLAG bit has been set. Because atomic_read() returns a signed integer, setting the highest bit makes the value negative and the expression if (unlikely(atomic_read(&req->poll_refs) >= IO_POLL_REF_BIAS)) always evaluates to false. As a result, the slow path that cancels a queued io_uring poll request is never entered, causing the request to remain pending indefinitely. This flaw can lead to resource exhaustion of kernel poll structures and ultimately a denial of service. The weakness involves incorrect signed comparison (CWE‑1024), integer overflow (CWE‑190), and ripple effects from erroneous loop logic (CWE‑835).

The vulnerability affects any Linux kernel build that has not incorporated the patch commit 326941b22806cbf2df1fbfe902b7908b368cce42 or an equivalent change. The CNA indicates the product as Linux:Linux and the CPES cover Linux kernel 6.1 and earlier release candidates. Hence, distribution kernels compiled from the impacted source code before the fix are vulnerable; versions 6.1 and all prior releases fall in this range.

The CVSS score of 7.8 denotes high severity, while the EPSS score of <1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, indicating no known widespread attacks. Attackers require local or existing kernel access with sufficient privileges to submit io_uring poll requests; the attack vector is inferred to be local, affecting any user sharing the compromised kernel instance. The risk is a localized denial of service that can exhaust kernel resources if the lock is left pending.