CVE-2026-99227

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory corruption issue exists in the io uring/waitid component. The io waitid function uses a 31-bit reference counter within the ->refs field, with bit 31 serving as a cancellation flag. In io waitid cancel(), the reference counter is incremented even when cancellation fails. Repeated failed cancellation attempts can cause the 31-bit reference field to wrap around to zero. This allows a subsequent cancellation attempt to incorrectly claim ownership and complete the request a second time, which may lead to kernel crashes or privilege escalation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.