PT-2026-135518
CVE-2026-99229
·
Published
2026-11-02
·
Updated
2026-11-02
Description by
Score
N/A
Not availableNo severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
io uring/wait: don't spin on a stuck overflow list
As long as IO CHECK CQ OVERFLOW BIT is set, io cqring wait schedule()
returns right away, before it gets to look at signals or arms the timeout,
for io cqring wait() to flush the overflow list. If that doesn't empty the
list, and the CQ ring doesn't hold the number of events the caller wants,
the loop starts over, with the same result. The task spins in the kernel,
and can't be killed.
The assumption is that this can't happen: if CQEs can't be flushed, the
ring is full, and min events is capped to the size of the ring. But:
-
With IORING SETUP CQE MIXED a 32b CQE needs two contiguous entries. It is stuck on the list if a single one is free, and then the ring holds less than cq entries events. A single threaded application that asks for as many events as the ring has entries never gets out of io uring enter().
-
Whether the ring is full is up to the CQ head, which the application can write to. While one thread waits for events on an empty ring, another one can move the head back so that the ring looks full and have a CQE overflow. The waiter can't be stopped any more, not even by SIGKILL.
Only the application can make room in the CQ ring. Return to it if the
list could not be flushed.
Found an issue in the description? Have something to add? Feel free to write us 👾