AZL-112628: CVE-2026-99263 affecting package kernel 6.6.159.1-1
In the Linux kernel, the following vulnerability has been resolved:
iouring/poll: avoid retry wakeup loss when dropping ownership
If a wakeup sets IOPOLLRETRYFLAG between the owning task consuming the existing instance of IOPOLLRETRYFLAG and the loop check of iopollcheckevents(), then we stall on processing the request until an unrelated wakeup comes along.
Using atomiccmpxchg instead of atomicsubreturn to guarantee both the count v and pollrefs are 0 and no wake-ups are missed.
Affected Software
Event History
Frequently Asked Questions
What conditions are needed for this issue to manifest?
The issue requires a race in io_uring poll wakeup handling: a wakeup must set IO_POLL_RETRY_FLAG after the owning task consumes the existing flag but before io_poll_check_events() performs its loop check. Under that timing, processing can stall until another unrelated wakeup occurs.
What is the operational impact if a system is affected?
An io_uring poll request can stop being processed because its retry wakeup is lost. Processing resumes only when an unrelated wakeup occurs.
How is the race addressed in the resolved kernel change?
The fix replaces atomic_sub_return with atomic_cmpxchg so that the count value and poll_refs are both confirmed to be zero without missing wakeups.