CVE-2026-99262
Received Received - Intake

Timeout Handling Race Condition in Linux Kernel io_uring

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: io_uring/timeout: don't lose a cancel as io-wq arms a timeout An IORING_OP_TIMEOUT run by io-wq, because of IOSQE_ASYNC, has the same problem as poll, futex and waitid. io_wq_submit_work() looks at IO_WQ_WORK_CANCEL once, before it issues the request. A cancel in between flags the work, gets -EALREADY, and searches ->timeout_list in vain, while the worker then adds the request and starts the timer: io-wq worker io_try_cancel() io_wq_submit_work() IO_WQ_WORK_CANCEL isn't set io_async_cancel_one() sets IO_WQ_WORK_CANCEL = -EALREADY io_timeout_cancel() = -ENOENT io_timeout() adds the request to ->timeout_list hrtimer_start() = IOU_ISSUE_SKIP_COMPLETE Nobody looks at the flag again, and the timeout runs its course. At ring exit, io_uring_try_cancel_requests() cancels io-wq work and then kills the timeouts the same way, so an exiting task can get stuck for the full duration of such a timeout. Look at the flag under ->timeout_lock, which the search takes as well, and fail the request if it is set. If the search came first, the flag is visible. If it comes later, it finds the request on the list.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-99262
EUVD
EUVD-2026-115787

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
Linux Linux ce35a47a3a0208a77b4d31b7f2e8ed57d624093d
Linux Linux ce35a47a3a0208a77b4d31b7f2e8ed57d624093d
Linux Linux ce35a47a3a0208a77b4d31b7f2e8ed57d624093d
Linux Linux ce35a47a3a0208a77b4d31b7f2e8ed57d624093d
Linux Linux ce35a47a3a0208a77b4d31b7f2e8ed57d624093d
Linux Linux 5.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the io_uring timeout mechanism when used with io-wq. A cancel operation can be missed if it occurs between checking the cancel flag and submitting the timeout request. This causes the timeout to run unnecessarily, potentially delaying task completion or causing system hangs during ring exit.

Detection Guidance

This vulnerability is specific to the Linux kernel's io_uring subsystem and requires kernel-level inspection. Detection involves checking kernel logs for io_uring timeout-related errors or analyzing running processes using io_uring. Commands like dmesg, journalctl, or checking /proc/kallsyms for io_uring functions may help. However, no direct detection commands are provided in the context.

Impact Analysis

An attacker could exploit this to cause denial-of-service by forcing timeouts to run longer than intended, leading to system hangs or delayed task completion. Systems relying on io_uring for I/O operations may experience unexpected delays or unresponsiveness.

Mitigation Strategies

Apply the latest Linux kernel patches or updates that address this issue. If patches are unavailable, consider disabling io_uring features temporarily or restricting access to untrusted users. Monitor kernel logs for signs of exploitation or unusual timeout behaviors.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-99262. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...