Linux Kernel CVE-2026-99227

Requires local access to a system where the io_uring subsystem is available and not disabled (e.g. not blocked via io_uring_disabled sysctl or seccomp policy), and the ability to submit an io_uring waitid operation and its cancellation. Per the description, the flaw is reached by issuing repeated FAILED cancellation attempts against a request owned by another path until the 31-bit reference counter (bits 30:0 of ->refs) wraps to zero, after which a later cancellation can claim ownership and complete the request a second time. Limiting factors: exploitation needs a local low-privileged account (PR:L), the counter wrap demands a very large volume of cancellation attempts (~2^31) making it timing- and resource-intensive, and winning the completion-ownership handoff is a race - all of which constrain reliability well below a simple one-shot trigger. Environments that disable io_uring for unprivileged users are not exposed.

Signals point to a genuine but non-emergency local kernel memory-corruption issue rather than a mass-exploitation threat. The input CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects full confidentiality, integrity and availability impact reachable by a low-privileged local user, consistent with an io_uring reference-count wrap that leads to a second completion of the same request (a double-completion / use-after-free class flaw). However, several escalation signals are ABSENT: no EPSS score is provided, the CVE is NOT listed in CISA KEV, and no public exploit or PoC reference is supplied (the four references are all kernel.org stable git commits, i.e. the fix itself). The vuln.today decision label is 'this_week', not 'act_now' or 'emergency', which is coherent with a patchable local bug lacking confirmed exploitation. A notable tension: the description shows the mechanism requires wrapping a 31-bit reference counter via repeated failed cancellation attempts - on the order of 2^31 operations plus winning a completion-ownership race - which materially raises real-world exploitation difficulty beyond what the input's AC:L implies; this is reflected in my independent assessed vector below. Also note the 'Information Disclosure' tag understates the issue: the described double-completion is a memory-corruption primitive (matching the C:H/I:H/A:H rating), not merely an info leak. Net: a real priority to patch in normal cycles, but not an actively-exploited internet-facing emergency.

A low-privileged local user with access to the io_uring interface submits a waitid request, then issues a very large number of failed cancellation attempts so that the 31-bit reference field wraps to zero; a subsequent cancellation then claims ownership and completes the same request a second time. This double completion yields a use-after-free style primitive that could be groomed toward kernel memory corruption and local privilege escalation. No public exploit or PoC was identified at time of analysis - the trigger details beyond the counter wrap and completion race are not described in the available sources.