Bug 2492097 (CVE-2026-52933) - CVE-2026-52933 kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership()
Summary: CVE-2026-52933 kernel: io_uring/poll: fix signed comparison in io_poll_get_ow...
Keywords:
Status: NEW
Alias: CVE-2026-52933
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-06-24 08:01 UTC by OSIDB Bzimport
Modified: 2026-09-16 14:07 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:64775 0 None None None 2026-09-08 07:19:45 UTC
Red Hat Product Errata RHSA-2026:64808 0 None None None 2026-09-08 09:25:24 UTC
Red Hat Product Errata RHSA-2026:65708 0 None None None 2026-09-09 01:06:29 UTC
Red Hat Product Errata RHSA-2026:67114 0 None None None 2026-09-14 13:34:22 UTC
Red Hat Product Errata RHSA-2026:68100 0 None None None 2026-09-16 14:07:41 UTC

Description OSIDB Bzimport 2026-06-24 08:01:51 UTC
In the Linux kernel, the following vulnerability has been resolved:

io_uring/poll: fix signed comparison in io_poll_get_ownership()

io_poll_get_ownership() uses a signed comparison to check whether
poll_refs has reached the threshold for the slowpath:

    if (unlikely(atomic_read(&req->poll_refs) >= IO_POLL_REF_BIAS))

atomic_read() returns int (signed). When IO_POLL_CANCEL_FLAG
(BIT(31)) is set in poll_refs, the value becomes negative in
signed arithmetic, so the >= 128 comparison always evaluates to
false and the slowpath is never taken.

Fix this by casting the atomic_read() result to unsigned int
before the comparison, so that the cancel flag is treated as a
large positive value and correctly triggers the slowpath.

Comment 1 Mauro Matteo Cascella 2026-06-24 12:41:40 UTC
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026062433-CVE-2026-52933-815c@gregkh/T

Comment 5 Akiyoshi Kurita 2026-08-26 02:54:38 UTC
FYI, a public exploit and demonstration for CVE-2026-53360 are now available.

Public PoC / exploit:
https://github.com/0xCyberstan/CVE-2026-53360-POC

Demo video:
https://x.com/nebusecurity/status/2092431446824878130

Relevant stable kernel fixes / reference patches:

RHEL 9 reference (6.1.175 backport):
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=81bf96b0abbfa4cd47ea32e12596aed3855fb2f3

RHEL 10 reference (6.12.86 backport):
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=fc47043f3d9af3efa407665b47f8378ec691ba18

Mitigation / exposure note:
Since io_uring is disabled by default on RHEL, practical exposure may be limited unless io_uring has been explicitly enabled.

Red Hat CVE page:
https://access.redhat.com/security/cve/cve-2026-53360

Comment 6 Akiyoshi Kurita 2026-08-26 03:23:39 UTC
Correction to Comment 5:

Comment 5 incorrectly referenced CVE-2026-53360 and included the wrong exploit URL.

The correct information for CVE-2026-52933 is as follows:

FYI, a public exploit and demonstration for CVE-2026-52933 are now available.

Red Hat CVE page:
https://access.redhat.com/security/cve/cve-2026-52933

Public exploit:
https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-52933-Fedora-6.19.10-300

Demo video:
https://x.com/nebusecurity/status/2092431446824878130

Relevant stable kernel fixes / reference patches:

RHEL 9 reference (6.1.175 backport):
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=81bf96b0abbfa4cd47ea32e12596aed3855fb2f3

RHEL 10 reference (6.12.86 backport):
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=fc47043f3d9af3efa407665b47f8378ec691ba18

Mitigation / exposure note:
Since io_uring is disabled by default on RHEL, practical exposure may be limited unless io_uring has been explicitly enabled.

Please disregard the incorrect CVE-2026-53360 references in Comment 5.

Comment 9 errata-xmlrpc 2026-09-08 07:19:45 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:64775 https://access.redhat.com/errata/RHSA-2026:64775

Comment 10 errata-xmlrpc 2026-09-08 09:25:23 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:64808 https://access.redhat.com/errata/RHSA-2026:64808

Comment 11 errata-xmlrpc 2026-09-09 01:06:28 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:65708 https://access.redhat.com/errata/RHSA-2026:65708

Comment 12 Jon Orris 2026-09-14 13:34:22 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:67114 https://access.redhat.com/errata/RHSA-2026:67114

Comment 13 Jon Orris 2026-09-16 14:07:40 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:68100 https://access.redhat.com/errata/RHSA-2026:68100


Note You need to log in before you can comment on or make changes to this bug.