Bug 2492097 (CVE-2026-52933) - CVE-2026-52933 kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership()
Summary: CVE-2026-52933 kernel: io_uring/poll: fix signed comparison in io_poll_get_ow...
Keywords:
Status: NEW
Alias: CVE-2026-52933
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-06-24 08:01 UTC by OSIDB Bzimport
Modified: 2026-08-26 13:31 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-06-24 08:01:51 UTC
In the Linux kernel, the following vulnerability has been resolved:

io_uring/poll: fix signed comparison in io_poll_get_ownership()

io_poll_get_ownership() uses a signed comparison to check whether
poll_refs has reached the threshold for the slowpath:

    if (unlikely(atomic_read(&req->poll_refs) >= IO_POLL_REF_BIAS))

atomic_read() returns int (signed). When IO_POLL_CANCEL_FLAG
(BIT(31)) is set in poll_refs, the value becomes negative in
signed arithmetic, so the >= 128 comparison always evaluates to
false and the slowpath is never taken.

Fix this by casting the atomic_read() result to unsigned int
before the comparison, so that the cancel flag is treated as a
large positive value and correctly triggers the slowpath.

Comment 1 Mauro Matteo Cascella 2026-06-24 12:41:40 UTC
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026062433-CVE-2026-52933-815c@gregkh/T

Comment 5 Akiyoshi Kurita 2026-08-26 02:54:38 UTC
FYI, a public exploit and demonstration for CVE-2026-53360 are now available.

Public PoC / exploit:
https://github.com/0xCyberstan/CVE-2026-53360-POC

Demo video:
https://x.com/nebusecurity/status/2092431446824878130

Relevant stable kernel fixes / reference patches:

RHEL 9 reference (6.1.175 backport):
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=81bf96b0abbfa4cd47ea32e12596aed3855fb2f3

RHEL 10 reference (6.12.86 backport):
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=fc47043f3d9af3efa407665b47f8378ec691ba18

Mitigation / exposure note:
Since io_uring is disabled by default on RHEL, practical exposure may be limited unless io_uring has been explicitly enabled.

Red Hat CVE page:
https://access.redhat.com/security/cve/cve-2026-53360

Comment 6 Akiyoshi Kurita 2026-08-26 03:23:39 UTC
Correction to Comment 5:

Comment 5 incorrectly referenced CVE-2026-53360 and included the wrong exploit URL.

The correct information for CVE-2026-52933 is as follows:

FYI, a public exploit and demonstration for CVE-2026-52933 are now available.

Red Hat CVE page:
https://access.redhat.com/security/cve/cve-2026-52933

Public exploit:
https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-52933-Fedora-6.19.10-300

Demo video:
https://x.com/nebusecurity/status/2092431446824878130

Relevant stable kernel fixes / reference patches:

RHEL 9 reference (6.1.175 backport):
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=81bf96b0abbfa4cd47ea32e12596aed3855fb2f3

RHEL 10 reference (6.12.86 backport):
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=fc47043f3d9af3efa407665b47f8378ec691ba18

Mitigation / exposure note:
Since io_uring is disabled by default on RHEL, practical exposure may be limited unless io_uring has been explicitly enabled.

Please disregard the incorrect CVE-2026-53360 references in Comment 5.


Note You need to log in before you can comment on or make changes to this bug.