CVE-2026-99267
Received Received - Intake

Memory Leak in Linux Kernel io_uring

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: io_uring/napi: make stale entries time out after 60s With dynamic tracking a NAPI id that hasn't been seen for a minute is meant to be dropped from the list the ring busy polls. The timeout is added to jiffies, but it is defined as 60 * SEC_CONVERSION, and SEC_CONVERSION isn't the number of jiffies in a second. It is the internal factor of __timespec64_to_jiffies(), HZ scaled up by SEC_JIFFIE_SC bits. For HZ=1000 that is 1000 << 22, which puts the timeout at about eight years. On 32-bit the multiplication overflows. So entries are never removed, and every id that a socket of the ring ever had keeps being polled on each wait.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-99267
EUVD
EUVD-2026-115792

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Linux Linux 8d0c12a80cdeb80d5e0510e96d38fe551ed8e9b5
Linux Linux 8d0c12a80cdeb80d5e0510e96d38fe551ed8e9b5
Linux Linux 8d0c12a80cdeb80d5e0510e96d38fe551ed8e9b5
Linux Linux 6.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves io_uring and NAPI. A stale NAPI ID that hasn't been seen for a minute should be removed from the ring's busy poll list. However, the timeout calculation uses an incorrect conversion factor (SEC_CONVERSION), which is not the number of jiffies in a second. For HZ=1000, this makes the timeout about eight years, causing entries to never be removed. On 32-bit systems, the multiplication overflows entirely.

Detection Guidance

This vulnerability is specific to the Linux kernel's io_uring subsystem and may not have direct network detection methods. Check kernel logs for io_uring-related errors or unusual polling activity. Use commands like 'dmesg | grep io_uring' or 'journalctl -k | grep io_uring' to inspect kernel messages for signs of stale NAPI entries.

Impact Analysis

This vulnerability can cause performance degradation as every socket ID ever used by the ring continues to be polled unnecessarily. This leads to increased CPU usage and potential system slowdowns. On 32-bit systems, it may cause crashes due to integer overflow.

Mitigation Strategies

Update the Linux kernel to a patched version where this issue is resolved. Monitor kernel updates from your distribution vendor and apply them promptly. If immediate patching is not possible, consider disabling io_uring temporarily if it is not critical for your system.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-99267. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...