PT-2026-51726 · Linux · Linux

Publicado 2026-06-24 · Atualizado 2026-06-24 · CVE-2026-52933

Mitre

In the Linux kernel, the following vulnerability has been resolved:

io uring/poll: fix signed comparison in io poll get ownership()

io poll get ownership() uses a signed comparison to check whether poll refs has reached the threshold for the slowpath:

if (unlikely(atomic read(&req->poll refs) >= IO POLL REF BIAS))

atomic read() returns int (signed). When IO POLL CANCEL FLAG (BIT(31)) is set in poll refs, the value becomes negative in signed arithmetic, so the >= 128 comparison always evaluates to false and the slowpath is never taken.

Fix this by casting the atomic read() result to unsigned int before the comparison, so that the cancel flag is treated as a large positive value and correctly triggers the slowpath.

Identificadores relacionados

CVE-2026-52933

Produtos afetados

Linux

Referências · 7

• https://git.kernel.org/stable/c/fc47043f3d9af3efa407665b47f8378ec691ba18 · Nota
• https://git.kernel.org/stable/c/c6d191164dc81838d8dbf452a6000f68c558d1ae · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-52933 · Nota de Segurança
• https://git.kernel.org/stable/c/ea0697129807d718037f618221037aa0660ee3c5 · Nota
• https://git.kernel.org/stable/c/81bf96b0abbfa4cd47ea32e12596aed3855fb2f3 · Nota
• https://git.kernel.org/stable/c/326941b22806cbf2df1fbfe902b7908b368cce42 · Nota
• https://git.kernel.org/stable/c/cf522703d4f194991615763697ae25a3f9539763 · Nota