Skip to main content

Linux Kernel EUVDEUVD-2026-38703

| CVE-2026-52933 HIGH
Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)
2026-06-24 Linux GHSA-37vf-c5qj-3jr7
Denial Of Service Linux
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local authenticated user can call io_uring (AV:L/PR:L), but reliable exploitation needs winning a cancellation race (AC:H); ownership corruption yields high C/I/A.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 08:27 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
Jun 24, 2026 - 09:16 EUVD
CVE Published
Jun 24, 2026 - 07:14 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 07:14 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

io_uring/poll: fix signed comparison in io_poll_get_ownership()

io_poll_get_ownership() uses a signed comparison to check whether poll_refs has reached the threshold for the slowpath:

if (unlikely(atomic_read(&req->poll_refs) >= IO_POLL_REF_BIAS))

atomic_read() returns int (signed). When IO_POLL_CANCEL_FLAG (BIT(31)) is set in poll_refs, the value becomes negative in signed arithmetic, so the >= 128 comparison always evaluates to false and the slowpath is never taken.

Fix this by casting the atomic_read() result to unsigned int before the comparison, so that the cancel flag is treated as a large positive value and correctly triggers the slowpath.

AnalysisAI

Local privilege escalation potential in the Linux kernel's io_uring poll subsystem arises from a signed-comparison flaw in io_poll_get_ownership(), where atomic_read() returns a signed int and the IO_POLL_CANCEL_FLAG (BIT(31)) makes poll_refs negative, so the '>= IO_POLL_REF_BIAS' slowpath check is never taken. Affecting kernels from the 5.15/6.x stable series through pre-patch 7.x, a local user with io_uring access can drive poll-reference accounting into an incorrect state during request cancellation, with CVSS 7.8 (AV:L) rating high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile), but a vendor patch is available across stable branches.

Technical ContextAI

The flaw lives in io_uring, the kernel's asynchronous I/O interface, specifically its poll ownership accounting (io_poll_get_ownership() in io_uring/poll.c). Ownership of a poll request is tracked via an atomic reference counter, poll_refs, where reaching IO_POLL_REF_BIAS (128) is meant to force a slowpath. Because atomic_read() returns a signed int and IO_POLL_CANCEL_FLAG is BIT(31), setting the cancel flag flips the value negative in two's-complement signed arithmetic; the comparison 'value >= 128' then always evaluates false and the slowpath that handles contended/cancelled references is skipped. The fix casts the atomic_read() result to unsigned int so the cancel flag reads as a large positive value and correctly triggers the slowpath. The root-cause class is an incorrect signed/unsigned integer comparison (CWE-195/CWE-697 family; NVD lists CWE as N/A), a classic sign-extension logic error rather than a memory-safety bug per se, though the broken ownership protocol can lead to use-after-free-style races on the request object.

RemediationAI

Apply the vendor-released kernel update for your branch: Vendor-released patch versions are 6.1.175, 6.6.140, 6.12.86, 6.18.27, 7.0.4, and 7.1 - upgrade to the patched point release matching your stable series, or pull the fix commits (e.g., 81bf96b0abbfa4cd47ea32e12596aed3855fb2f3 and the other backports) from git.kernel.org/stable. Most distributions will ship this in routine kernel errata, so prioritize the standard distro kernel update channel and reboot. If immediate patching is not possible, the most effective compensating control is to restrict or disable io_uring exposure: set the sysctl kernel.io_uring_disabled=2 to block io_uring system calls system-wide (trade-off: breaks applications that depend on io_uring, such as some high-performance databases and proxies), or scope it via the kernel.io_uring_group sysctl to permit only trusted groups. Reducing untrusted local-user access and container workloads that can issue io_uring syscalls further limits the local attack surface. Reference advisories: https://nvd.nist.gov/vuln/detail/CVE-2026-52933 and https://vuldb.com/vuln/373197.

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

View all
CVE-2024-20353 HIGH POC
8.6
CVE-2020-13935 HIGH POC
7.5
CVE-2017-16944 HIGH POC
7.5
CVE-2022-0778 HIGH POC
7.5
CVE-2024-43366 CRITICAL POC
9.1
CVE-2026-25533 HIGH POC
8.8
CVE-2018-8002 HIGH POC
8.8
CVE-2026-66730 HIGH POC
8.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.177 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.155 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.206 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.152 Affected
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected

Share

EUVD-2026-38703 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy