Linux Kernel Vulnerability in io_uring and NAPI Functionality

CVE-2026-99267

What is CVE-2026-99267?

A vulnerability exists in the Linux kernel's handling of stale entries within the io_uring and NAPI subsystems. Specifically, when dynamic tracking identifies a NAPI ID that hasn't been used for a minute, that ID should be removed from the polling list. However, the timeout logic is improperly defined, leading to a situation where entries are never cleared due to incorrect calculations regarding jiffies. This flaw can result in excessive polling of stale entries, potentially degrading system performance and resource management over prolonged periods. Addressing this issue helps maintain optimal kernel functionality and ensures efficient resource utilization.

References