UBUNTU-CVE-2026-99227: High severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: prevent cancel reference wrap iowaitid packs the cancellation state into bit 31 of ->refs and uses bits 30:0 as a 31-bit reference counter: #define IOWAITIDCANCELFLAG BIT(31) #define IOWAITIDREFMASK GENMASK(30, 0) iowaitidcancel() marks a request canceled, then increments the low bits of ->refs to claim completion ownership. When another path owns the request, the increment remains even though cancellation returns false. The request remains discoverable by cancellation, so repeated failed attempts can wrap the 31-bit reference field to zero. A later cancellation can claim ownership and complete the request a second time. Use atomicfetchor() when setting the cancel flag and inspect the old flag value. The first cancel attempt continues to the existing ownership increment, preserving its wake and issuer handoff semantics. Later attempts see the cancel flag and return without incrementing the reference field. This makes repeated failed cancellation attempts idempotent while leaving the first-cancel state transitions unchanged.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update io_uring/waitid cancellation handling to set the cancel flag with atomic_fetch_or() and inspect the old flag value, so repeated failed cancellation attempts do not increment and wrap the 31-bit reference field; preserve the first cancellation attempt's ownership increment and wake/issuer handoff semantics.
Event History
Frequently Asked Questions
Which Ubuntu kernel packages are identified as affected?
The listed affected software includes Ubuntu linux, linux-fips, linux-aws, linux-azure, linux-gcp, linux-oracle, linux-aws-fips, and linux-azure-fips kernel packages.
What access does an attacker need to exploit this issue?
The severity vector indicates local attack access, low attack complexity, low privileges required, and no user interaction. Successful exploitation is rated as having high impact on confidentiality, integrity, and availability.
What condition leads to the reference counter wrapping?
Repeated cancellation attempts must fail while the request is owned by another path but remains discoverable for cancellation. Each failed attempt previously incremented the 31-bit reference field, allowing it eventually to wrap to zero and enabling a later cancellation to complete the request a second time.
What does the fix change?
The fix uses atomic_fetch_or() to set the cancellation flag and checks whether that flag was already set. The first cancellation retains the existing ownership increment and handoff behavior, while later cancellation attempts return without incrementing the reference counter.