CVE-2026-53321: Linux Kernel io_uring NAPI DoS Flaw

CVE-2026-53321 Overview

CVE-2026-53321 affects the Linux kernel's io_uring/napi subsystem. The vulnerability stems from an uncapped busy-poll loop in NAPI (New API) processing when no events are found. Without a maximum polling duration or conditional rescheduling within the loop, the kernel can flag the task as stuck. This produces kernel complaints related to preemption and scheduler stalls on affected systems using io_uring with NAPI busy polling enabled.

The upstream fix caps busy_poll_to at 10 milliseconds. This ceiling remains well above any value that produces measurable polling benefits while staying below the threshold that triggers preemption warnings.

Critical Impact

Local workloads using io_uring with NAPI busy polling can trigger kernel task-stuck warnings and scheduling anomalies on systems running unpatched kernels.

Affected Products

• Linux kernel versions containing the io_uring/napi busy-poll implementation prior to the fix
• Distributions shipping kernels without the backported patch series
• Systems using io_uring with NAPI busy polling enabled for network I/O workloads

Discovery Timeline

• 2026-06-26 - CVE-2026-53321 published to NVD
• 2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-53321

Vulnerability Analysis

The defect resides in the io_uring NAPI busy-poll path. When a caller requests network completions through io_uring and enables NAPI busy polling, the kernel enters a loop that polls the network device for incoming events. The original implementation placed no upper bound on the polling duration when no events materialized.

The loop lacked a call to cond_resched() or equivalent yield points. Long polls monopolize the CPU on the caller's task, and the scheduler cannot preempt cooperatively. On kernels compiled with preemption debugging or RCU stall detection, this behavior surfaces as task-stuck warnings and softlockup complaints.

The class of defect falls under improper resource management in a kernel busy-loop, closely related to unbounded loop conditions that manifest as denial-of-service on the local task. Impact is limited to the calling process, but noisy kernel logs and scheduling stalls can degrade host stability.

Root Cause

The io_uring NAPI busy-poll routine iterated on polling attempts without tracking cumulative elapsed time and without releasing the CPU. Absent a ceiling on busy_poll_to, a user-supplied value or default configuration could keep the CPU spinning past scheduler tolerance thresholds.

Attack Vector

A local user process invoking io_uring with NAPI busy polling configured can trigger the condition without special privileges. No network-borne exploitation path is documented. The vulnerability produces reliability and observability impact rather than memory corruption or privilege escalation.

The fix introduces a 10 millisecond cap on total busy-poll time. See the upstream commits 39767f944a8c, cb3af525f8df, and df8599ee18c0 for the exact code changes.

Detection Methods for CVE-2026-53321

Indicators of Compromise

• Kernel log entries reporting task-stuck warnings referencing io_uring or NAPI busy-poll functions
• INFO: rcu_sched detected stalls messages correlated with processes using io_uring
• Softlockup or hung-task detector output naming threads active in io_napi_busy_loop

Detection Strategies

• Query kernel version data across the fleet and compare against distribution advisories referencing the three upstream commits
• Correlate application crashes or timeouts with dmesg output containing io_uring and NAPI symbols
• Inspect workloads that call io_uring_setup with IORING_SETUP_SQPOLL or that enable NAPI busy polling via io_uring_register

Monitoring Recommendations

• Forward dmesg and /var/log/messages to a central log store and alert on task ... blocked for more than patterns
• Track kernel scheduler latency metrics through perf sched or eBPF-based observability tooling
• Monitor CPU utilization spikes on cores serving io_uring-heavy workloads to identify prolonged busy-poll windows

How to Mitigate CVE-2026-53321

Immediate Actions Required

• Inventory hosts running kernels that include io_uring NAPI busy-poll support and identify workloads that enable it
• Apply the vendor kernel update containing the three referenced upstream commits and reboot affected systems
• If patching is deferred, disable NAPI busy polling on io_uring instances by not registering the NAPI tracking option

Patch Information

The upstream fix caps busy_poll_to at 10 milliseconds. Apply the patches referenced by commits 39767f944a8c, cb3af525f8df, and df8599ee18c0. Consult your Linux distribution's security advisories for backported package versions.

Workarounds

• Avoid registering NAPI busy polling with io_uring_register on unpatched kernels
• Constrain user-configurable busy-poll timeout values through application-level policy where NAPI polling is required
• Where feasible, migrate high-throughput I/O workloads to interrupt-driven completion paths until the kernel patch is deployed

# Verify running kernel version and check for the fix commit in changelog
uname -r
rpm -q --changelog kernel | grep -E "39767f944a8c|cb3af525f8df|df8599ee18c0"
# On Debian/Ubuntu
dpkg -l | grep linux-image
apt changelog linux-image-$(uname -r) | grep -E "io_uring.*napi|busy_poll_to"