The Linux kernel contains a flaw in the io_uring NAPI idle‑entry handling where the timeout for a stale entry is calculated with an incorrect conversion factor. The value used, 60 * SEC_CONVERSION, does not represent 60 seconds in jiffies; instead, for HZ=1000 it expands to about eight years, and on 32‑bit systems the 32‑bit multiplication overflows. As a consequence, stale identifiers remain in the busy‑poll list indefinitely, so any socket that ever used the ring continues to be polled on each wait. This leads to unnecessary CPU and memory consumption that can degrade performance or trigger a denial‑of‑service condition over time. An attacker who can repeatedly create and submit io_uring requests could accelerate resource exhaustion, but the bug does not grant arbitrary code execution.

All Linux kernel deployments that enable io_uring are affected. Vendor/product information is ‘Linux kernel’. No specific kernel versions are listed, so the issue may exist in any kernel prior to the commit that fixed the timeout. Both 32‑bit and 64‑bit architectures are impacted because the overflow calculation is architecture‑agnostic.

There is no published CVSS score or EPSS value, and the vulnerability is not in the CISA KEV catalog, indicating limited exploitation evidence. However, the flaw causes a long‑term resource drain that could degrade service availability, especially on systems with many io_uring sockets or minimal resource isolation. The attack vector would likely involve local or remote privileged users who can open io_uring handles, but the steep resource demands reduce the practicality of a successful, rapid exploit.