High 7.8Published Jun 24, 2026

CVE-2026-52933io_uring/poll: fix signed comparison in io_poll_get_ownership()

Updated under an hour ago (Oct 26, 2026, 9:00 PM ET)

Does this affect you?

It affects Linux and 4 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: io_uring/poll: fix signed comparison in io_poll_get_ownership() io_poll_get_ownership() uses a signed comparison to check whether poll_refs has reached the threshold for the slowpath: if (unlikely(atomic_read(&req->poll_refs) >= IO_POLL_REF_BIAS)) atomic_read() returns int (signed). When IO_POLL_CANCEL_FLAG (BIT(31)) is set in poll_refs, the value becomes negative in signed arithmetic, so the >= 128 comparison always evaluates to false and the slowpath is never taken. Fix this by casting the atomic_read() result to unsigned int before the comparison, so that the cancel flag is treated as a large positive value and correctly triggers the slowpath.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-190
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from a26a35e9019fd70bf3cf647dcfdae87abc7bacea before 81bf96b0abbfa4cd47ea32e12596aed3855fb2f3; from a26a35e9019fd70bf3cf647dcfdae87abc7bacea before cf522703d4f194991615763697ae25a3f9539763; from a26a35e9019fd70bf3cf647dcfdae87abc7bacea before fc47043f3d9af3efa407665b47f8378ec691ba18; from a26a35e9019fd70bf3cf647dcfdae87abc7bacea before ea0697129807d718037f618221037aa0660ee3c5; from a26a35e9019fd70bf3cf647dcfdae87abc7bacea before c6d191164dc81838d8dbf452a6000f68c558d1ae; from a26a35e9019fd70bf3cf647dcfdae87abc7bacea before 326941b22806cbf2df1fbfe902b7908b368cce42; 4b702b7d11ce1b9d26fc6d7c5a7ef4ac1d455048; bc4e6ee16778149811333a969a7a893d4cc110c5; and 2 more ranges	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 5.15.82 before 5.16; from 6.0.11 before 6.1; from 6.1.1 before 6.1.175; from 6.2 before 6.6.140; from 6.7 before 6.12.86; from 6.13 before 6.18.27; from 6.19 before 7.0.4; 6.1; and 2 more ranges	NVD

References

References

https://git.kernel.org/stable/c/81bf96b0abbfa4cd47ea32e12596aed3855fb2f3	patch
https://git.kernel.org/stable/c/cf522703d4f194991615763697ae25a3f9539763	patch
https://git.kernel.org/stable/c/fc47043f3d9af3efa407665b47f8378ec691ba18	patch
https://git.kernel.org/stable/c/ea0697129807d718037f618221037aa0660ee3c5	patch
https://git.kernel.org/stable/c/c6d191164dc81838d8dbf452a6000f68c558d1ae	patch
https://git.kernel.org/stable/c/326941b22806cbf2df1fbfe902b7908b368cce42	patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.