CVE-2026-52933: Linux Kernel Poll Comparison Vulnerability

CVE-2026-52933 Overview

CVE-2026-52933 affects the Linux kernel's io_uring subsystem, specifically the poll ownership logic in io_poll_get_ownership(). The function uses a signed comparison against IO_POLL_REF_BIAS to decide whether to take the slowpath when poll references reach a threshold. When IO_POLL_CANCEL_FLAG (BIT(31)) is set in poll_refs, the signed integer value becomes negative, causing the >= 128 comparison to evaluate to false. The slowpath is therefore never entered when cancellation is in progress, leading to incorrect ownership handling for in-flight poll requests on cancellation paths.

Critical Impact
The signed comparison error prevents the io_uring poll slowpath from running when the cancel flag is set, breaking the cancellation path for poll requests in the Linux kernel.

Affected Products

Linux kernel io_uring subsystem (io_uring/poll.c)
Stable kernel branches receiving the backported fixes referenced in the kernel.org commits
Distributions shipping affected stable kernels prior to applying the patch

Discovery Timeline

2026-06-24 - CVE-2026-52933 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52933

Vulnerability Analysis

The defect resides in io_poll_get_ownership() within the Linux kernel's io_uring poll implementation. The function gates entry into a slowpath based on the current value of the poll_refs atomic counter compared to IO_POLL_REF_BIAS (128). The comparison is written as atomic_read(&req->poll_refs) >= IO_POLL_REF_BIAS, and atomic_read() returns a signed int.

When the cancellation flag IO_POLL_CANCEL_FLAG (BIT(31)) is encoded into poll_refs, bit 31 is set. Interpreted as a signed integer, this value becomes negative. A negative number is never >= 128, so the conditional always evaluates to false and the slowpath is skipped. This is a sign extension and improper input validation problem rooted in numeric type handling [CWE-195].

Root Cause

The root cause is the use of signed arithmetic on a bitfield that intentionally uses the sign bit (BIT(31)) as a flag. The fix casts the result of atomic_read() to unsigned int before the threshold comparison, ensuring the cancel flag is treated as a large positive value and the slowpath is taken when expected.

Attack Vector

The issue is reachable from any local context that can submit io_uring poll requests and trigger cancellation, which is a common operation in workloads using asynchronous I/O. The impact is functional: poll requests carrying the cancel bit do not transition into the slowpath, which can lead to incorrect reference accounting and missed cancellations rather than direct privilege escalation. There is no public exploit, and the EPSS score remains low.

No verified proof-of-concept code is publicly available. The corrective patches are tracked in the kernel.org stable tree commits 326941b, 81bf96b, c6d1911, cf52270, ea06971, and fc47043. See the Kernel Git Commit fc47043 and related references for the exact source changes.

Detection Methods for CVE-2026-52933

Indicators of Compromise

No host-based indicators of compromise are published for this issue, as it is a logic flaw rather than a remotely exploitable memory corruption.
Unexpected hangs, stuck poll requests, or anomalies in io_uring cancellation behavior on unpatched kernels may correlate with the bug.

Detection Strategies

Inventory running kernel versions across Linux fleets and compare against the patched stable releases listed in the kernel.org commit references.
Audit application use of io_uring poll operations and cancellations in workloads such as databases, proxies, and async runtimes.
Track kernel package versions through configuration management to identify hosts still running the vulnerable io_poll_get_ownership() implementation.

Monitoring Recommendations

Monitor kernel logs and tracepoints for io_uring poll cancellation anomalies, including stuck requests or unexpected reference counts.
Alert on Linux hosts whose kernel build date or version predates the merge of the referenced stable commits.
Correlate kernel package update events with vulnerability management telemetry to confirm patch deployment.

How to Mitigate CVE-2026-52933

Immediate Actions Required

Apply the upstream Linux kernel patch that casts the atomic_read() result in io_poll_get_ownership() to unsigned int before comparison.
Update to a distribution-supplied kernel that backports the fix from the referenced stable commits.
Reboot affected systems after kernel update to ensure the patched code path is loaded.

Patch Information

The fix is committed to the Linux stable tree. Reference the following commits for the exact change: Kernel Git Commit 326941b, Kernel Git Commit 81bf96b, Kernel Git Commit c6d1911, Kernel Git Commit cf52270, Kernel Git Commit ea06971, and Kernel Git Commit fc47043. The patch replaces the signed comparison with an unsigned comparison so the cancel flag bit is treated as a large positive value.

Workarounds

No supported workaround exists short of applying the kernel patch.
Where patching is delayed, restrict execution of untrusted workloads that exercise io_uring poll cancellation paths on affected hosts.
Consider disabling io_uring for unprivileged users via sysctl kernel.io_uring_disabled on kernels that expose this control, until the patch is applied.

bash

# Verify kernel version and disable io_uring for unprivileged users where supported
uname -r
sysctl -w kernel.io_uring_disabled=2