Linux kernel io_uring/waitid: repeated failed cancellations wrap the reference counter and double-complete a request

Impact

__io_waitid_cancel() increments the 31-bit reference field in io_waitid->refs even when it fails to claim the request, and the request stays discoverable by cancellation. Repeated failed cancel attempts wrap the counter to zero, after which a later cancellation claims ownership and completes the request a second time - a double free of a request object reachable from unprivileged code. This is a separate defect from the ->head ordering bug in the same file; the fix here is to use atomic_fetch_or() and return early when the cancel flag was already set. Exposure is the same local-escalation shape on a multi-tenant GPU node, and the remedy is a kernel update, not a configuration change.

Who can reach it

Local unprivileged user or container process able to submit io_uring waitid requests and issue cancellations against them in a loop. No remote vector.

What to do

Apply the stable kernel commits listed in the advisory or the distro kernel containing them, then drain and reboot each affected node. Disabling io_uring for untrusted workloads (seccomp, or kernel.io_uring_disabled) is an interim mitigation that needs no reboot.

References

Related entries

• Linux kernel io_uring/waitid: use-after-free when the wake handler clears ->head before owning the requestCVE-2026-99231 · Linux kernel io_uring waitid (use-after-free via ->head cleared before ownership)High
• Linux kernel sched_ext: DSQ consume and move paths operate on a task still being dispatchedCVE-2026-99269 · Linux kernel sched_ext (DSQ consume/move racing SCX_OPSS_DISPATCHING)High
• xrdp: out-of-bounds read parsing Confirm Active PDU crashes the server or leaks process memoryCVE-2026-33516 · xrdp (RDP capability exchange, Confirm Active PDU parsing)High
• Linux kernel virtio-gpu: unvalidated EDID block offset lets a malicious backend read past a kernel bufferCVE-2026-68255 · Linux kernel drm/virtio (virtio_get_edid_block response bounds)High
• Linux kernel (drivers/pci): The option-ROM parser trusts the header and data-structure offsets it reads out of theCVE-2026-72487 · Linux kernel (drivers/pci)High
• VMware Tools for Windows: improper authorisation lets a guest user reach other guest VMs on the same vCenter or ESXCVE-2025-41246 · VMware Tools for Windows (guest access control)High