Kernel Spin Vulnerability in Linux Affecting IO_URING Mechanism

CVE-2026-99229

What is CVE-2026-99229?

A vulnerability in the Linux kernel's IO_uring mechanism causes a task to spin indefinitely when it encounters a stuck overflow list due to improper handling of completion queue events. This issue arises under specific conditions where the number of events requested exceeds the capacity of the completion queue (CQ). If an application triggers a situation where the CQ becomes full while waiting for events, it can lead to a deadlock scenario, preventing the task from being terminated even with signals like SIGKILL. An affected system can experience degraded performance and unresponsiveness as the application remains trapped in waiting states.

References