In the Linux kernel, the following vulnerability has been resolved: iouring/wait: don't spin on a stuck overflow list As long as…
CVE-2026-99229
In the Linux kernel, the following vulnerability has been resolved: iouring/wait: don't spin on a stuck overflow list As long as IOCHECKCQOVERFLOWBIT is set, iocqringwaitschedule() returns right away, before it gets to look at signals or arms the timeout, for iocqringwait() to flush the overflow list. If that doesn't empty the list, and the CQ ring doesn't hold the number of events the caller wants, the loop starts over, with the same result. The task spins in the kernel, and can't be killed. The assumption is that this can't happen: if CQEs can't be flushed, the ring is full, and minevents is capped to the size of the ring. But: With IORINGSETUPCQEMIXED a 32b CQE needs two contiguous entries. It is stuck on the list if a single one is free, and then the ring holds less than cqentries events. A single threaded application that asks for as many events as the ring has entries never gets out of iouringenter(). Whether the ring is full is up to the CQ head, which the application can write to. While one thread waits for events on an empty ring, another one can move the head back so that the ring looks full and have a CQE overflow. The waiter can't be stopped any more, not even by…
Assessment
- CVSS
- Not yet scored
- Severity
- Unscored
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 2 November 2026
- Last updated
- 2 November 2026
- Assigner
- Linux
At the source
References
- https://git.kernel.org/stable/c/bf1d2ed84b3162e3b0e0bb7018ac59147da6e975
- https://git.kernel.org/stable/c/a6cfc85c6bf9498aaf1978b503f9663635a1aa22
- https://git.kernel.org/stable/c/4a89352edd8b3e20d1e1fb33f0fc297dd137149f
- https://git.kernel.org/stable/c/c347691e5dc5481b2d6943c123619e04847fb0dc
- https://nvd.nist.gov/vuln/detail/CVE-2026-99229
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-99229