CVE-2026-52933
Analyzed
Analyzed - Analysis Complete
Integer Overflow in Linux Kernel io_uring Polling Mechanism
Vulnerability report for CVE-2026-52933, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-06-24
Last updated on: 2026-07-08
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
io_uring/poll: fix signed comparison in io_poll_get_ownership()
io_poll_get_ownership() uses a signed comparison to check whether
poll_refs has reached the threshold for the slowpath:
if (unlikely(atomic_read(&req->poll_refs) >= IO_POLL_REF_BIAS))
atomic_read() returns int (signed). When IO_POLL_CANCEL_FLAG
(BIT(31)) is set in poll_refs, the value becomes negative in
signed arithmetic, so the >= 128 comparison always evaluates to
false and the slowpath is never taken.
Fix this by casting the atomic_read() result to unsigned int
before the comparison, so that the cancel flag is treated as a
large positive value and correctly triggers the slowpath.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.1 |
| linux | linux_kernel | 6.1 |
| linux | linux_kernel | 6.1 |
| linux | linux_kernel | From 6.0.11 (inc) to 6.1 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.86 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.140 (exc) |
| linux | linux_kernel | From 6.1.1 (inc) to 6.1.175 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.27 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 7.0.4 (exc) |
| linux | linux_kernel | From 5.15.82 (inc) to 5.16 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-835 | The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. |
