VulnerabilityPublished 2 Nov 2026

CVE-2026-99229: Linux kernel · io_uring/wait: don't spin on a stuck overflow list

Source GCVE Database

Compare

Authoritative record:CVE-2026-99229· High

Not known to be exploited · fixed in c347691e5dc5481b2d6943c123619e04847fb0dc : patch Linux kernel soon.

Data as of 2 Nov 2026, 19:28 UTC

Severity

High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in c347691e5dc5481b2d6943c123619e04847fb0dc, bf1d2ed84b3162e3b0e0bb7018ac59147da6e975, a6cfc85c6bf9498aaf1978b503f9663635a1aa22 +1

Exploitation evidence

Disclosed: evidence found.
CVE published 2 Nov 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-v4v7-2v4c-64vj

What to do

Upgrade Linux kernel to c347691e5dc5481b2d6943c123619e04847fb0dc, bf1d2ed84b3162e3b0e0bb7018ac59147da6e975, a6cfc85c6bf9498aaf1978b503f9663635a1aa22 or 4a89352edd8b3e20d1e1fb33f0fc297dd137149f.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 3fcf19d592d5cb63eb209400b22055651e3c27d0, < c347691e5dc5481b2d6943c123619e04847fb0dc	Fixed in c347691e5dc5481b2d6943c123619e04847fb0dc
LinuxLinux	Affected ≥ 3fcf19d592d5cb63eb209400b22055651e3c27d0, < bf1d2ed84b3162e3b0e0bb7018ac59147da6e975	Fixed in bf1d2ed84b3162e3b0e0bb7018ac59147da6e975
LinuxLinux	Affected ≥ 3fcf19d592d5cb63eb209400b22055651e3c27d0, < a6cfc85c6bf9498aaf1978b503f9663635a1aa22	Fixed in a6cfc85c6bf9498aaf1978b503f9663635a1aa22
LinuxLinux	Affected ≥ 3fcf19d592d5cb63eb209400b22055651e3c27d0, < 4a89352edd8b3e20d1e1fb33f0fc297dd137149f	Fixed in 4a89352edd8b3e20d1e1fb33f0fc297dd137149f
LinuxLinux	Affected =6.3	Fixed in–

AI-suggested

If you cannot patch yet, applications should avoid conditions that cause CQE overflow or manipulation of the CQ head that can lead to this stuck state. Monitoring vendor advisories for an official fix is recommended.

Description

CVE-2026-99229 is a Linux kernel vulnerability in the io_uring subsystem where a task can spin indefinitely on a stuck overflow list. This occurs because io_cqring_wait_schedule() returns early when IO_CHECK_CQ_OVERFLOW_BIT is set, preventing proper flushing of the overflow list and causing the task to spin in the kernel without responding to signals, including SIGKILL. The issue arises especially with IORING_SETUP_CQE_MIXED and when the application manipulates the completion queue head, leading to a stuck state that cannot be interrupted.

Impact

A task waiting on io_uring events can become stuck spinning in the kernel, unable to be killed or interrupted by signals such as SIGKILL. This can lead to resource exhaustion or denial of service conditions in applications relying on io_uring for asynchronous I/O operations. The kernel task spinning indefinitely may degrade system responsiveness or stability.

Summary

This vulnerability in the Linux kernel's io_uring implementation involves the wait logic on the completion queue overflow list. When IO_CHECK_CQ_OVERFLOW_BIT is set, io_cqring_wait_schedule() returns immediately before flushing the overflow list or checking signals, causing a loop where the task spins in kernel space. The problem is exacerbated by the IORING_SETUP_CQE_MIXED flag, which requires two contiguous completion queue entries for a 32-bit CQE, potentially leaving entries stuck on the overflow list. Additionally, the application can manipulate the CQ head pointer to create a condition where the ring appears full but contains overflowed CQEs, causing the waiting task to become unkillable. The only resolution is for the application to make room in the CQ ring to clear the overflow list.

References

Community reviews

Loading reviews…