Linux kernel io_uring poll: cancel flag makes the ownership slowpath unreachable

Impact

io_poll_get_ownership() compared the poll reference count as a signed int. Once IO_POLL_CANCEL_FLAG (bit 31) is set the value reads as negative, the >= IO_POLL_REF_BIAS check never fires, and the slowpath that is supposed to take over reference handling is skipped. NVD scores this local with full confidentiality, integrity and availability loss, which is the usual shape of an io_uring reference-handling bug reachable by any local process. On a GPU node this matters because io_uring is available to unprivileged code inside tenant containers unless it has been deliberately restricted, so the boundary being tested is container-to-host, not user-to-user. The record is a stable-tree fix with no exploit detail, so treat the severity as the kernel maintainers' rating rather than a demonstrated escape.

Who can reach it

Local, unauthenticated beyond having code execution on the node: any process that can issue io_uring polled operations, which includes workloads in an ordinary tenant container unless io_uring has been blocked by seccomp policy or the io_uring_disabled sysctl.

What to do

Take the stable kernel that carries the fix commit from your distribution and reboot each node; there is no runtime toggle for this code path. That means draining GPU jobs and rebooting the whole fleet, so most operators will fold it into the next kernel maintenance window. Until then, restricting io_uring for untrusted workloads (seccomp deny of io_uring_setup, or the kernel's io_uring disable knob) removes the reachable path without a reboot.

References

Related entries

• Linux kernel (net/xfrm): ESP-in-TCP keeps a single in-flight transmit. For a blocking caller the flush of that stateCVE-2026-52935 · Linux kernel (net/xfrm)High
• Linux kernel PSI: use-after-free racing a cgroup pressure write against cgroup removalCVE-2026-52991 · Linux kernel sched/psi (cgroup pressure files)High
• Linux kernel ccp driver: IV restore overruns the 8-byte RFC3686 IV bufferCVE-2026-53016 · Linux kernel crypto/ccp (AMD Cryptographic Coprocessor, RFC3686 CTR-AES)High
• Linux BPF offload: refcount increment on a dying netns causes use-after-free during info queryCVE-2026-53089 · Linux kernel BPF offload (bpf_map/prog_offload_info_fill_ns netns refcount)High
• Linux kernel BPF verifier: ld_abs/ld_ind failure path left unverified inside subprogramsCVE-2026-53090 · Linux kernel BPF verifier (ld_abs/ld_ind in subprograms)High
• Linux kernel BPF verifier: mis-tracked rX += rX delta lets a program diverge from its verified boundsCVE-2026-53092 · Linux kernel BPF verifier (linked-register delta tracking in adjust_reg_min_max_vals())High