{"id":"CVE-2026-99267","published":"2026-11-03T12:17:33.860","lastModified":"2026-11-03T20:18:32.400","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/napi: make stale entries time out after 60s\n\nWith dynamic tracking a NAPI id that hasn't been seen for a minute is\nmeant to be dropped from the list the ring busy polls. The timeout is\nadded to jiffies, but it is defined as 60 * SEC_CONVERSION, and\nSEC_CONVERSION isn't the number of jiffies in a second. It is the\ninternal factor of __timespec64_to_jiffies(), HZ scaled up by\nSEC_JIFFIE_SC bits. For HZ=1000 that is 1000 << 22, which puts the\ntimeout at about eight years. On 32-bit the multiplication overflows.\n\nSo entries are never removed, and every id that a socket of the ring\never had keeps being polled on each wait.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/18c373f446068972788158c8c7de6e849b04ed98","tags":[]},{"url":"https://git.kernel.org/stable/c/3fe820cf35f83534eab72ea73f1a83cfd3cd8079","tags":[]},{"url":"https://git.kernel.org/stable/c/981621d6eadcd232d4ea748aaeb046337f10d3c1","tags":[]},{"url":"https://git.kernel.org/stable/c/9c151648780d89e5446e5f89f3fa2e416c3bb911","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}