Cancellation State Management Vulnerability in Linux Kernel

CVE-2026-99227

What is CVE-2026-99227?

A vulnerability exists in the Linux kernel related to the io_uring's handling of cancellation states. It arises from the way the cancellation state is packed into the reference counter. If multiple cancellation attempts are made, the reference counter can mistakenly wrap around to zero, allowing an unauthorized re-ownership claim on requests. This flaw poses a risk to system stability and security by potentially enabling repeated cancellation attempts without proper handling, which could lead to unintended consequences. A fix has been implemented to ensure idempotent behavior for failed cancellations while preserving the original request ownership semantics.

References