UBUNTU-CVE-2026-99267: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: iouring/napi: make stale entries time out after 60s With dynamic tracking a NAPI id that hasn't been seen for a minute is meant to be dropped from the list the ring busy polls. The timeout is added to jiffies, but it is defined as 60 SECCONVERSION, and SECCONVERSION isn't the number of jiffies in a second. It is the internal factor of timespec64tojiffies(), HZ scaled up by SECJIFFIESC bits. For HZ=1000 that is 1000 << 22, which puts the timeout at about eight years. On 32-bit the multiplication overflows. So entries are never removed, and every id that a socket of the ring ever had keeps being polled on each wait.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running one of the listed Ubuntu kernel packages may be affected when io_uring uses dynamic NAPI ID tracking and busy polling. The impact is tied to rings that have sockets whose NAPI IDs are tracked over time.
What conditions are needed to trigger the problem?
A socket associated with an io_uring ring must have a NAPI ID added to the dynamically tracked list. When that ID is no longer seen, it should expire after one minute, but the faulty timeout calculation prevents timely removal.
What is the operational impact?
Stale NAPI IDs remain in the ring's busy-poll list, causing every ID ever associated with a socket on that ring to continue being polled on each wait. On kernels with HZ=1000, entries can persist for about eight years; on 32-bit systems, the timeout multiplication can overflow.
How can administrators identify a potentially affected workload?
Look for io_uring workloads using NAPI busy polling with dynamic tracking, particularly rings that have handled sockets with changing or numerous NAPI IDs. The observable behavior is continued polling of IDs that should have been dropped after roughly one minute.