VulnerabilityPublished 2 Nov 2026

CVE-2026-99229: Linux kernel · io_uring/wait: don't spin on a stuck overflow list

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in c347691e5dc5481b2d6943c123619e04847fb0dc : patch Linux kernel soon.

Data as of 2 Nov 2026, 16:31 UTC

Severity

High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in c347691e5dc5481b2d6943c123619e04847fb0dc, bf1d2ed84b3162e3b0e0bb7018ac59147da6e975, a6cfc85c6bf9498aaf1978b503f9663635a1aa22 +1

Exploitation evidence

Disclosed: evidence found.
CVE published 2 Nov 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to c347691e5dc5481b2d6943c123619e04847fb0dc, bf1d2ed84b3162e3b0e0bb7018ac59147da6e975, a6cfc85c6bf9498aaf1978b503f9663635a1aa22 or 4a89352edd8b3e20d1e1fb33f0fc297dd137149f.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 3fcf19d592d5cb63eb209400b22055651e3c27d0, < c347691e5dc5481b2d6943c123619e04847fb0dc	Fixed in c347691e5dc5481b2d6943c123619e04847fb0dc
LinuxLinux	Affected ≥ 3fcf19d592d5cb63eb209400b22055651e3c27d0, < bf1d2ed84b3162e3b0e0bb7018ac59147da6e975	Fixed in bf1d2ed84b3162e3b0e0bb7018ac59147da6e975
LinuxLinux	Affected ≥ 3fcf19d592d5cb63eb209400b22055651e3c27d0, < a6cfc85c6bf9498aaf1978b503f9663635a1aa22	Fixed in a6cfc85c6bf9498aaf1978b503f9663635a1aa22
LinuxLinux	Affected ≥ 3fcf19d592d5cb63eb209400b22055651e3c27d0, < 4a89352edd8b3e20d1e1fb33f0fc297dd137149f	Fixed in 4a89352edd8b3e20d1e1fb33f0fc297dd137149f
LinuxLinux	Affected =6.3	Fixed in–

AI-suggested

A fix for this vulnerability is available in specific Linux kernel commits (c347691e5dc5481b2d6943c123619e04847fb0dc, bf1d2ed84b3162e3b0e0bb7018ac59147da6e975, a6cfc85c6bf9498aaf1978b503f9663635a1aa22, 4a89352edd8b3e20d1e1fb33f0fc297dd137149f). Users and administrators should update to a Linux kernel version including these fixes to prevent the kernel task spin condition. No other mitigation is indicated; the application must ensure proper CQ ring management.

Description

A vulnerability in the Linux kernel's io_uring subsystem causes a kernel task to spin indefinitely on a stuck overflow list, preventing it from being killed. This occurs when the completion queue (CQ) ring appears full due to CQE overflow conditions, especially with mixed CQE entries or manipulated CQ head pointers. The issue is fixed in certain Linux kernel commits.

Impact

The vulnerability causes a kernel task to spin indefinitely in the kernel, which cannot be terminated even by SIGKILL. This can lead to denial of service conditions where processes waiting on io_uring events become unresponsive and consume CPU resources indefinitely. The issue affects single-threaded applications requesting as many events as the ring size and multi-threaded scenarios where the CQ head is manipulated. There is no indication of privilege escalation or data corruption from the provided data.

Summary

CVE-2026-99229 addresses a flaw in the Linux kernel's io_uring implementation where io_cqring_wait_schedule() returns early if IO_CHECK_CQ_OVERFLOW_BIT is set, causing io_cqring_wait() to spin in a loop if the overflow list cannot be flushed and the CQ ring does not contain the requested number of events. This leads to a kernel task spinning indefinitely and becoming unkillable. The problem arises particularly with IORING_SETUP_CQE_MIXED where a 32-bit CQE requires two contiguous entries, causing stuck entries and fewer events than expected. Additionally, the CQ head pointer can be manipulated by another thread to simulate a full ring and cause CQE overflow, preventing the waiting thread from stopping even via SIGKILL. The fix ensures that if the overflow list cannot be flushed, control returns to the application to make room in the CQ ring.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 2 Nov 2026, 16:31 UTC

Technical details

References

Community reviews

Related threats