Linux Kernel EUVD-2026-39856

Exploitation requires a local account with at minimum standard user privileges (PR:L per CVSS). The target kernel must have io_uring enabled (CONFIG_IO_URING=y) and NAPI busy-poll support present, which was introduced at commit 8d0c12a80cdeb80d5e0510e96d38fe551ed8e9b5 (Linux 6.9). The attacker must call IORING_REGISTER_NAPI with a deliberately oversized busy_poll_to value and submit operations against a socket that will not receive events during the poll window. Exploitation is limited to the local machine with no network-facing attack surface. Systems running patched kernel versions (6.18.33+, 7.0.10+, 7.1+), kernels compiled without io_uring NAPI support, or those restricting io_uring access via sysctl or seccomp are not exploitable.

The NVD-assigned CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately characterizes the attack surface: exploitation is strictly local, requiring at minimum a low-privileged shell account and a kernel with io_uring NAPI compiled in. EPSS of 0.15% at the 5th percentile corroborates negligible exploitation interest from the threat intelligence community. No KEV listing and no known public POC further depress practical risk. Real-world priority is low for most environments; the primary concern is accidental misconfiguration by developers in high-performance networking stacks (e.g., DPDK-adjacent workloads) who inadvertently set extreme poll timeouts, rather than deliberate adversarial exploitation. The 'Information Disclosure' tag in source intelligence is inconsistent with CVSS C:N - verify tagging in downstream tooling and treat this solely as an availability issue. No conflicting signals between CVSS and description were identified.

A local attacker with a standard user account opens an io_uring instance, registers a NAPI configuration via IORING_REGISTER_NAPI with an extremely large busy_poll_to value (e.g., UINT_MAX microseconds), and submits network-bound operations on a quiet socket producing no events. The kernel NAPI poll loop spins without yielding, starving other tasks and triggering soft lockup watchdog messages - potentially hanging the affected CPU core and degrading overall system availability. No public POC exploit has been identified at time of analysis.