VulnerabilityPublished 3 Nov 2026

CVE-2026-99268: Linux kernel · io_uring: wake ring pollers for local task_work

Source GCVE Database

Compare

Authoritative record:CVE-2026-99268· Medium

Not known to be exploited · fixed in d8c618747a6aa90022e19ec614aa7157d0302108 : update Linux kernel when convenient.

Data as of 3 Nov 2026, 13:15 UTC

Severity

Medium

Rated by Threat Radar · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in d8c618747a6aa90022e19ec614aa7157d0302108, 92bfadcbe0a9a001beb5e58a2abaf040b873deb6, 9bb28e7740ce78beecafc5db074b45f4cbeb8a47 +1

Exploitation evidence

Disclosed: evidence found.
CVE published 3 Nov 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 3 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-497m-fpw9-92rh

What to do

Upgrade Linux kernel to d8c618747a6aa90022e19ec614aa7157d0302108, 92bfadcbe0a9a001beb5e58a2abaf040b873deb6, 9bb28e7740ce78beecafc5db074b45f4cbeb8a47 or 2c88d978f1dfd03edf67924ea8fd25cc45499eef.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 130bd686d9be918e4cc8c03abf5794ba2d860502, < d8c618747a6aa90022e19ec614aa7157d0302108	Fixed in d8c618747a6aa90022e19ec614aa7157d0302108
LinuxLinux	Affected ≥ 130bd686d9be918e4cc8c03abf5794ba2d860502, < 92bfadcbe0a9a001beb5e58a2abaf040b873deb6	Fixed in 92bfadcbe0a9a001beb5e58a2abaf040b873deb6
LinuxLinux	Affected ≥ 130bd686d9be918e4cc8c03abf5794ba2d860502, < 9bb28e7740ce78beecafc5db074b45f4cbeb8a47	Fixed in 9bb28e7740ce78beecafc5db074b45f4cbeb8a47
LinuxLinux	Affected ≥ 130bd686d9be918e4cc8c03abf5794ba2d860502, < 2c88d978f1dfd03edf67924ea8fd25cc45499eef	Fixed in 2c88d978f1dfd03edf67924ea8fd25cc45499eef
LinuxLinux	Affected =6.3	Fixed in–

AI-suggested

A fix has been applied in the Linux kernel to wake the poll wait queue appropriately when local task work is queued, using an RCU callback to avoid locking issues. Users should update to the fixed kernel version once available. No additional mitigation steps are indicated.

Description

CVE-2026-99268 is a vulnerability in the Linux kernel's io_uring subsystem related to waking ring pollers for local task work. The issue involves the handling of deferred completions (IORING_SETUP_DEFER_TASKRUN) where local work completions are queued but may not properly wake tasks waiting on poll or epoll, potentially causing delays in processing completion queue events. The fix involves waking the poll wait queue when the first entry is added to the work list, using an RCU callback to avoid locking issues.

Impact

The vulnerability may cause delays or failures in notifying applications waiting on io_uring file descriptors via poll or epoll that local work completions are ready. This could lead to performance degradation or unexpected behavior in applications relying on timely completion notifications. There is no indication of privilege escalation, code execution, or data corruption from the provided information.

References

Community reviews

Loading reviews…