Linux kernel io_uring poll: cancel flag makes the ownership slowpath unreachable

Impact

io_poll_get_ownership() compared the poll reference count as a signed int. Once IO_POLL_CANCEL_FLAG (bit 31) is set the value reads as negative, the >= IO_POLL_REF_BIAS check never fires, and the slowpath that is supposed to take over reference handling is skipped. NVD scores this local with full confidentiality, integrity and availability loss, which is the usual shape of an io_uring reference-handling bug reachable by any local process. On a GPU node this matters because io_uring is available to unprivileged code inside tenant containers unless it has been deliberately restricted, so the boundary being tested is container-to-host, not user-to-user. The record is a stable-tree fix with no exploit detail, so treat the severity as the kernel maintainers' rating rather than a demonstrated escape.

Who can reach it

Local, unauthenticated beyond having code execution on the node: any process that can issue io_uring polled operations, which includes workloads in an ordinary tenant container unless io_uring has been blocked by seccomp policy or the io_uring_disabled sysctl.

What to do

Take the stable kernel that carries the fix commit from your distribution and reboot each node; there is no runtime toggle for this code path. That means draining GPU jobs and rebooting the whole fleet, so most operators will fold it into the next kernel maintenance window. Until then, restricting io_uring for untrusted workloads (seccomp deny of io_uring_setup, or the kernel's io_uring disable knob) removes the reachable path without a reboot.

References

Related entries

• Linux kernel (net/xfrm): ESP-in-TCP keeps a single in-flight transmit. For a blocking caller the flush of that stateCVE-2026-52935 · Linux kernel (net/xfrm)High
• Linux kernel ceph: __ceph_setxattr leaks the preallocated xattr blob on the retry pathCVE-2026-52962 · Linux kernel CephFS client (__ceph_setxattr buffer leak)High
• Linux kernel PSI: use-after-free racing a cgroup pressure write against cgroup removalCVE-2026-52991 · Linux kernel sched/psi (cgroup pressure files)High
• Linux kernel ice driver: double free of transmit skb on the TSO/checksum error pathCVE-2026-53009 · Linux kernel ice driver (Intel E810 transmit path tx_buf handling)High
• Linux kernel ccp driver: IV restore overruns the 8-byte RFC3686 IV bufferCVE-2026-53016 · Linux kernel crypto/ccp (AMD Cryptographic Coprocessor, RFC3686 CTR-AES)High
• Linux kernel BPF arena: unvalidated NUMA node_id passed down the page allocation chainCVE-2026-53031 · Linux kernel BPF arena (arena_alloc_pages node_id validation)High