Linux Kernel Vulnerability in io_uring Functionality Affecting Multiple Versions

CVE-2026-99254

What is CVE-2026-99254?

A vulnerability in the Linux kernel affects the io_uring functionality, specifically in how cancelling tasks are managed and processed. When a task that utilizes io_uring is cancelled, the system queues multiple callbacks incessantly, leading to a potential Denial of Service condition. This results in tasks consuming excess CPU resources while preventing the execution of critical cancellations, which can cause significant performance issues. Without the need for elevated privileges, an affected task can remain occupied indefinitely, undermining system responsiveness. It is crucial for system administrators to apply available patches to mitigate these risks.

References