UBUNTU-CVE-2026-99267

Dashboard / Vulnerabilities / UBUNTU-CVE-2026-99267

UBUNTU-CVE-2026-99267

Summary:

Details: In the Linux kernel, the following vulnerability has been resolved: io_uring/napi: make stale entries time out after 60s With dynamic tracking a NAPI id that hasn't been seen for a minute is meant to be dropped from the list the ring busy polls. The timeout is added to jiffies, but it is defined as 60 * SEC_CONVERSION, and SEC_CONVERSION isn't the number of jiffies in a second. It is the internal factor of __timespec64_to_jiffies(), HZ scaled up by SEC_JIFFIE_SC bits. For HZ=1000 that is 1000 << 22, which puts the timeout at about eight years. On 32-bit the multiplication overflows. So entries are never removed, and every id that a socket of the ring ever had keeps being polled on each wait.

References: https://ubuntu.com/security/CVE-2026-99267, https://www.cve.org/CVERecord?id=CVE-2026-99267, https://git.kernel.org/stable/c/18c373f446068972788158c8c7de6e849b04ed98, https://git.kernel.org/stable/c/3fe820cf35f83534eab72ea73f1a83cfd3cd8079, https://git.kernel.org/stable/c/981621d6eadcd232d4ea748aaeb046337f10d3c1