CVE-2026-99227 is a vulnerability in the Linux kernel's io_uring subsystem related to cancellation reference counting. The flaw allows repeated failed cancellation attempts to wrap a 31-bit reference counter to zero, potentially enabling a request to be completed twice. This issue has been resolved by making cancellation attempts idempotent, ensuring only the first cancel attempt affects the reference count and subsequent attempts do not increment it.