UBUNTU-CVE-2026-99263: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: iouring/poll: avoid retry wakeup loss when dropping ownership If a wakeup sets IOPOLLRETRYFLAG between the owning task consuming the existing instance of IOPOLLRETRYFLAG and the loop check of iopollcheckevents(), then we stall on processing the request until an unrelated wakeup comes along. Using atomiccmpxchg instead of atomicsubreturn to guarantee both the count v and pollrefs are 0 and no wake-ups are missed.
Affected Software
Event History
Frequently Asked Questions
Which Ubuntu kernel package families are listed as affected?
The listed package families are linux, linux-fips, linux-aws, linux-azure, linux-gcp, linux-oracle, linux-aws-fips, and linux-azure-fips.
What operational symptom could indicate this issue is occurring?
A poll-related io_uring request can stall and remain unprocessed until an unrelated wakeup occurs.
What race condition triggers the stall?
The issue occurs when a wakeup sets IO_POLL_RETRY_FLAG after the owning task consumes the existing flag but before io_poll_check_events() performs its loop check.