CVE-2026-99267

✕ Withdrawn — historical dataUNRATEDCVSS · not yet scored
—

In the Linux kernel, the following vulnerability has been resolved:

io_uring/napi: make stale entries time out after 60s

With dynamic tracking a NAPI id that hasn't been seen for a minute is meant to be dropped from the list the ring busy polls. The timeout is added to jiffies, but it is defined as 60 * SEC_CONVERSION, and SEC_CONVERSION isn't the number of jiffies in a second. It is the internal factor of __timespec64_to_jiffies(), HZ scaled up by SEC_JIFFIE_SC bits. For HZ=1000 that is 1000 << 22, which puts the timeout at about eight years. On 32-bit the multiplication overflows.

So entries are never removed, and every id that a socket of the ring ever had keeps being polled on each wait.

CVSS v3
—
EchelonGraph score
Not yet assessedThis CVE record was withdrawn by its numbering authority, so there is no vulnerability to rate.
EPSS PROB
—
EPSS %ILE
—
KEV
—Not applicable: this CVE ID was withdrawn

Published

November 3, 2026

Last Modified

November 3, 2026

References (4)

Frequently asked(3)

What is CVE-2026-99267?
CVE-2026-99267 is a rejected CVE ID: its record was withdrawn on November 4, 2026 and no longer describes a vulnerability. Reason given: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
When was the CVE record for CVE-2026-99267 published?
The CVE record for CVE-2026-99267 was published on November 3, 2026. EchelonGraph's copy of the record carries a last-modified date of November 3, 2026; the record at its source may have been updated since.
How do I remediate CVE-2026-99267?
There is nothing to remediate under CVE-2026-99267: it is a rejected (withdrawn) CVE ID and no longer describes a vulnerability.