CVE-2026-99263

In the Linux kernel, the following vulnerability has been resolved:

io uring/poll: avoid retry wakeup loss when dropping ownership

If a wakeup sets IO POLL RETRY FLAG between the owning task consuming the existing instance of IO POLL RETRY FLAG and the loop check of io poll check events(), then we stall on processing the request until an unrelated wakeup comes along.

Using atomic cmpxchg instead of atomic sub return to guarantee both the count v and poll refs are 0 and no wake-ups are missed.