CVE-2026-99227 - Vulnerability Details

- io_uring/waitid: prevent cancel reference wrap

Description

In the Linux kernel, the following vulnerability has been resolved:

io_uring/waitid: prevent cancel reference wrap

io_waitid packs the cancellation state into bit 31 of ->refs and uses
bits 30:0 as a 31-bit reference counter:

#define IO_WAITID_CANCEL_FLAG BIT(31)
#define IO_WAITID_REF_MASK GENMASK(30, 0)

__io_waitid_cancel() marks a request canceled, then increments the low
bits of ->refs to claim completion ownership. When another path owns the
request, the increment remains even though cancellation returns false.
The request remains discoverable by cancellation, so repeated failed
attempts can wrap the 31-bit reference field to zero. A later
cancellation can claim ownership and complete the request a second time.

Use atomic_fetch_or() when setting the cancel flag and inspect the old
flag value. The first cancel attempt continues to the existing ownership
increment, preserving its wake and issuer handoff semantics. Later
attempts see the cancel flag and return without incrementing the
reference field.

This makes repeated failed cancellation attempts idempotent while
leaving the first-cancel state transitions unchanged.

Published: 2026-11-02

Score: 7.8 High

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

The flaw exists in the Linux kernel’s io_uring waitid implementation. Cancellation state is stored in bit 31 of the reference field while bits 30:0 serve as a 31‑bit counter. When a cancellation attempt fails, the counter is still incremented; repeated failures can wrap the counter back to zero. A later cancellation can then claim ownership and complete the request a second time, potentially disrupting normal operation.

Affected Systems

All Linux kernel builds that include the io_uring framework are affected. The generic Linux kernel CPE indicates the issue applies broadly within kernel releases that provide this subsystem, with no specific version bound documented in the advisory.

Risk and Exploitability

The CVSS score of 7.8 classifies the issue as high severity. EPSS is not available, so the likelihood of exploitation cannot be quantified. The vulnerability is local; a process with sufficient privileges can trigger the counter wrap by repeatedly issuing cancellation attempts. The effect could be double completion or resource mismanagement, and the kernel could exhibit instability. The vulnerability is not listed in the CISA KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`f31ecf671ddc498f20219453395794ff2383e06b`	affected	< 20b67288574c7c3df6b8ea7ed3b7af90a868006f
`f31ecf671ddc498f20219453395794ff2383e06b`	affected	< 5bfeee1774791602a0d53eb717f00f172127a017
`f31ecf671ddc498f20219453395794ff2383e06b`	affected	< 857aa2012b91cad6fdef54a4b6c632d9d0b6e64f
`f31ecf671ddc498f20219453395794ff2383e06b`	affected	< 22fb4a4518e305164c7f203608287564de292f34

Linux

affected

Version	Status	Constraints
`6.7`	affected	—
`0`	unaffected	< 6.7
`6.12.115`	unaffected	≤ 6.12.*
`6.18.60`	unaffected	≤ 6.18.*
`7.2.14`	unaffected	≤ 7.2.*
`7.3.1`	unaffected	≤ 7.3.*

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[f31ecf671ddc498f20219453395794ff2383e06b,20b67288574c7c3df6b8ea7ed3b7af90a868006f)`	affected	code_commit	—
`[f31ecf671ddc498f20219453395794ff2383e06b,5bfeee1774791602a0d53eb717f00f172127a017)`	affected	code_commit	—
`[f31ecf671ddc498f20219453395794ff2383e06b,857aa2012b91cad6fdef54a4b6c632d9d0b6e64f)`	affected	code_commit	—
`[f31ecf671ddc498f20219453395794ff2383e06b,22fb4a4518e305164c7f203608287564de292f34)`	affected	code_commit	—

Linux

100%

Version	Status	Scheme	Platform
`6.7`	affected	generic	—
`[0,6.7)`	unaffected	generic	—
`[6.12.115,6.13.0)`	unaffected	semver	—
`[6.18.60,6.19.0)`	unaffected	semver	—
`[7.2.14,7.3.0)`	unaffected	semver	—
`[7.3.1,7.4.0)`	unaffected	semver	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[f31ecf671ddc498f20219453395794ff2383e06b,20b67288574c7c3df6b8ea7ed3b7af90a868006f)`	affected	code_commit	—
`[f31ecf671ddc498f20219453395794ff2383e06b,5bfeee1774791602a0d53eb717f00f172127a017)`	affected	code_commit	—
`[f31ecf671ddc498f20219453395794ff2383e06b,857aa2012b91cad6fdef54a4b6c632d9d0b6e64f)`	affected	code_commit	—
`[f31ecf671ddc498f20219453395794ff2383e06b,22fb4a4518e305164c7f203608287564de292f34)`	affected	code_commit	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`6.7`	affected	generic	—
`[0,6.7)`	unaffected	generic	—
`[6.12.115,6.13.0)`	unaffected	semver	—
`[6.18.60,6.19.0)`	unaffected	semver	—
`[7.2.14,7.3.0)`	unaffected	semver	—
`[7.3.1,7.4.0)`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel patch introduced in commit 20b6728 to fix the wraparound behavior.
If an update is not possible, disable or avoid using io_uring in affected systems, for example by recompiling the kernel without the CONFIG_IO_URING option or by removing relevant runtime flags from applications.
Monitor processes for excessive cancellation activity and terminate those that repeat cancellations beyond normal limits.

Generated by OpenCVE AI on November 2, 2026 at 19:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/20b67288574c7c3df6b8ea7ed3b7af90a868006f
https://git.kernel.org/stable/c/22fb4a4518e305164c7f203608287564de292f34
https://git.kernel.org/stable/c/5bfeee1774791602a0d53eb717f00f172127a017
https://git.kernel.org/stable/c/857aa2012b91cad6fdef54a4b6c632d9d0b6e64f

History

Mon, 02 Nov 2026 20:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-190

Mon, 02 Nov 2026 18:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Mon, 02 Nov 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: prevent cancel reference wrap io_waitid packs the cancellation state into bit 31 of ->refs and uses bits 30:0 as a 31-bit reference counter: #define IO_WAITID_CANCEL_FLAG BIT(31) #define IO_WAITID_REF_MASK GENMASK(30, 0) __io_waitid_cancel() marks a request canceled, then increments the low bits of ->refs to claim completion ownership. When another path owns the request, the increment remains even though cancellation returns false. The request remains discoverable by cancellation, so repeated failed attempts can wrap the 31-bit reference field to zero. A later cancellation can claim ownership and complete the request a second time. Use atomic_fetch_or() when setting the cancel flag and inspect the old flag value. The first cancel attempt continues to the existing ownership increment, preserving its wake and issuer handoff semantics. Later attempts see the cancel flag and return without incrementing the reference field. This makes repeated failed cancellation attempts idempotent while leaving the first-cancel state transitions unchanged.
Title		io_uring/waitid: prevent cancel reference wrap
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/20b67288574c7c3df6b8ea7ed3b7af90a868006f https://git.kernel.org/stable/c/22fb4a4518e305164c7f203608287564de292f34 https://git.kernel.org/stable/c/5bfeee1774791602a0d53eb717f00f172127a017 https://git.kernel.org/stable/c/857aa2012b91cad6fdef54a4b6c632d9d0b6e64f
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-11-02T16:06:36.101Z

Updated: 2026-11-02T16:06:36.101Z

Reserved: 2026-09-25T10:25:14.402Z

Link: CVE-2026-99227

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-11-02T16:17:47.420

Modified: 2026-11-02T16:17:47.420

Link: CVE-2026-99227

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-11-02T19:45:17Z

Weaknesses

CWE-190
Integer Overflow or Wraparound

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object