Look up another CVE · open CVE-2026-52933 in the interactive tracker
CVE-2026-52933
io_uring/poll: fix signed comparison in io_poll_get_ownership()
Published 2026-06-24 (4 months ago) by the Linux kernel CNA. Subsystem io_uring. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-52933 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4665-1 · 2026-07-03 · text | 6.1.176-1 | Update the kernel and reboot. DLA-4665-1 shipped the fix on 2026-07-03, in 6.1.176-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.86-1 | Update the kernel and reboot. Fixed in 6.12.86-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.0.4-1 | Update the kernel and reboot. Fixed in 7.0.4-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.4-1 | Update the kernel and reboot. Fixed in 7.0.4-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
io_poll_get_ownership() uses a signed comparison to check whether poll_refs has reached the threshold for the slowpath: if (unlikely(atomic_read(&req->poll_refs) >= IO_POLL_REF_BIAS)) atomic_read() returns int (signed). When IO_POLL_CANCEL_FLAG (BIT(31)) is set in poll_refs, the value becomes negative in signed arithmetic, so the >= 128 comparison always evaluates to false and the slowpath is never taken. Fix this by casting the atomic_read() result to unsigned int before the comparison, so that the cancel flag is treated as a large positive value and correctly triggers the slowpath.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
io_uring/poll.c
- What this is
- IO_URINGMAINTAINERS section matched on io_uring/ · io-uring@vger.kernel.org · Maintained
Check it on the machine
grep -w CONFIG_IO_URING /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
- Build switch
- CONFIG_IO_URING
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-06-24 (4 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.15%, higher than 3.6% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- io_uring
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.1 | 6.1.175 | 81bf96b0abbf |
| 6.1 | 6.6.140 | cf522703d4f1 |
| 6.1 | 6.12.86 | fc47043f3d9a |
| 6.1 | 6.18.27 | ea0697129807 |
| 6.1 | 7.0.4 | c6d191164dc8 |
| 6.1 | 7.1 | 326941b22806 |
| 5.15.82 | 0 | 0 |
| 6.0.11 | 0 | 0 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4671-1 | 2026-07-05 | bullseye 6.1.176-1~deb11u1 | tracker |
| DLA-4665-1 | 2026-07-03 | bookworm 6.1.176-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The vulnerable path is reached by local `io_uring_setup()`/`io_uring_enter()` submissions of poll and cancel operations, not by remote packets or physical access.
- AC:LAttack complexity, low
- An attacker can create the ring, choose pollable file descriptors, submit cancels/removes, and generate concurrent wakeups; the race participants are attacker-controlled.
- PR:LPrivileges required, low
- With the default `io_uring_disabled=0`, an unprivileged local user can create and use io_uring; no real root or init-namespace capability is required.
- UI:NUser interaction, none
- Exploitation does not require another user to mount, open, or process anything; the attacker drives the syscall and file-descriptor activity directly.
- S:UScope, unchanged
- This is a kernel request-lifetime/ownership bug within the same host kernel security authority, not a VM, IOMMU, or separate security-scope escape.
- C:HConfidentiality impact, high
- The signedness bug defeats the poll_refs overflow/ownership slow path after cancellation, allowing ref-bit wrap and duplicate ownership/completion of an `io_kiocb`; that is UAF-style kernel memory corruption with plausible memory disclosure.
- I:HIntegrity impact, high
- The same duplicate ownership/completion and request lifetime corruption can plausibly be shaped into arbitrary kernel memory modification or control-flow compromise, so integrity impact is high.
- A:HAvailability impact, high
- At minimum, corrupted poll ownership and duplicate completion can trigger kernel warnings, NULL dereferences, UAF crashes, or hangs in a local attacker-controlled loop.