PT-2026-51726 · Linux · Linux
Published
2026-06-24
·
Updated
2026-06-24
·
CVE-2026-52933
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
io uring/poll: fix signed comparison in io poll get ownership()
io poll get ownership() uses a signed comparison to check whether
poll refs has reached the threshold for the slowpath:
if (unlikely(atomic read(&req->poll refs) >= IO POLL REF BIAS))
atomic read() returns int (signed). When IO POLL CANCEL FLAG
(BIT(31)) is set in poll refs, the value becomes negative in
signed arithmetic, so the >= 128 comparison always evaluates to
false and the slowpath is never taken.
Fix this by casting the atomic read() result to unsigned int
before the comparison, so that the cancel flag is treated as a
large positive value and correctly triggers the slowpath.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux