{"id":"CVE-2026-99227","published":"2026-11-02T16:17:47.420","lastModified":"2026-11-02T16:17:47.420","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/waitid: prevent cancel reference wrap\n\nio_waitid packs the cancellation state into bit 31 of ->refs and uses\nbits 30:0 as a 31-bit reference counter:\n\n  #define IO_WAITID_CANCEL_FLAG BIT(31)\n  #define IO_WAITID_REF_MASK    GENMASK(30, 0)\n\n__io_waitid_cancel() marks a request canceled, then increments the low\nbits of ->refs to claim completion ownership. When another path owns the\nrequest, the increment remains even though cancellation returns false.\nThe request remains discoverable by cancellation, so repeated failed\nattempts can wrap the 31-bit reference field to zero. A later\ncancellation can claim ownership and complete the request a second time.\n\nUse atomic_fetch_or() when setting the cancel flag and inspect the old\nflag value. The first cancel attempt continues to the existing ownership\nincrement, preserving its wake and issuer handoff semantics. Later\nattempts see the cancel flag and return without incrementing the\nreference field.\n\nThis makes repeated failed cancellation attempts idempotent while\nleaving the first-cancel state transitions unchanged.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/20b67288574c7c3df6b8ea7ed3b7af90a868006f","tags":[]},{"url":"https://git.kernel.org/stable/c/22fb4a4518e305164c7f203608287564de292f34","tags":[]},{"url":"https://git.kernel.org/stable/c/5bfeee1774791602a0d53eb717f00f172127a017","tags":[]},{"url":"https://git.kernel.org/stable/c/857aa2012b91cad6fdef54a4b6c632d9d0b6e64f","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}