VulnerabilityPublished 3 Nov 2026

CVE-2026-99268: Linux kernel · io_uring: wake ring pollers for local task_work

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in d8c618747a6aa90022e19ec614aa7157d0302108 : update Linux kernel when convenient.

Data as of 3 Nov 2026, 12:13 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in d8c618747a6aa90022e19ec614aa7157d0302108, 92bfadcbe0a9a001beb5e58a2abaf040b873deb6, 9bb28e7740ce78beecafc5db074b45f4cbeb8a47 +1

Exploitation evidence

Disclosed: evidence found.
CVE published 3 Nov 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 3 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to d8c618747a6aa90022e19ec614aa7157d0302108, 92bfadcbe0a9a001beb5e58a2abaf040b873deb6, 9bb28e7740ce78beecafc5db074b45f4cbeb8a47 or 2c88d978f1dfd03edf67924ea8fd25cc45499eef.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 130bd686d9be918e4cc8c03abf5794ba2d860502, < d8c618747a6aa90022e19ec614aa7157d0302108	Fixed in d8c618747a6aa90022e19ec614aa7157d0302108
LinuxLinux	Affected ≥ 130bd686d9be918e4cc8c03abf5794ba2d860502, < 92bfadcbe0a9a001beb5e58a2abaf040b873deb6	Fixed in 92bfadcbe0a9a001beb5e58a2abaf040b873deb6
LinuxLinux	Affected ≥ 130bd686d9be918e4cc8c03abf5794ba2d860502, < 9bb28e7740ce78beecafc5db074b45f4cbeb8a47	Fixed in 9bb28e7740ce78beecafc5db074b45f4cbeb8a47
LinuxLinux	Affected ≥ 130bd686d9be918e4cc8c03abf5794ba2d860502, < 2c88d978f1dfd03edf67924ea8fd25cc45499eef	Fixed in 2c88d978f1dfd03edf67924ea8fd25cc45499eef
LinuxLinux	Affected =6.3	Fixed in–

AI-suggested

A fix for this vulnerability has been implemented in the Linux kernel. Users and administrators should update to the fixed kernel versions identified by the commit hashes provided. No additional mitigation steps are required beyond applying the official kernel update.

Description

A vulnerability in the Linux kernel's io_uring subsystem related to waking ring pollers for local task work has been resolved. The issue involves the handling of deferred task completions and the waking of poll wait queues, which could cause tasks to sleep indefinitely waiting for completion events. The fix ensures that the poll wait queue is properly woken when local work is queued, preventing potential stalls in event notification.

Impact

The vulnerability could cause tasks waiting on io_uring completions via poll or epoll to sleep indefinitely because the poll wait queue was not properly woken when local work was queued. This could lead to stalled event processing and degraded application responsiveness relying on io_uring for asynchronous I/O completion notifications.

Summary

CVE-2026-99268 addresses a flaw in the Linux kernel's io_uring implementation where completions queued as local work with IORING_SETUP_DEFER_TASKRUN only become completion queue events (CQEs) when the submitter enters the kernel to wait for events. The polling mechanism (poll/epoll) on the ring file descriptor reports readiness only if local work is pending at the time of the call. Previously, the wake-up mechanism for tasks sleeping in poll() was replaced by waking the submitter directly, which failed to wake the poll wait queue (->poll_wq) when local work was queued. This could cause the submitter to sleep indefinitely. The fix restores waking of ->poll_wq when the first entry is added to the work list, using an RCU callback to avoid deadlocks when work is queued from a wake-up handler.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 3 Nov 2026, 12:00 UTC

Technical details

References

Community reviews

Related threats