A signed io_uring counter could allow two owners at once

Summary

An io_uring polling counter stored both a cancellation flag and a reference count in one signed integer. Once the top-bit cancellation flag was set, a signed comparison treated the whole value as negative and skipped the overflow-safe path.

The bug was introduced in November 2022 and fixed upstream in April 2026. The public exploit was later validated against Fedora 44 with its normal SELinux and randomized allocation-cache protections.

Why it mattered

No special namespace capability was required for the affected io_uring operations. By forcing enough concurrent wakeups during cancellation, a local process could make two workers believe they exclusively owned the same request, creating a use-after-free or other kernel memory corruption.

The affected code has been fixed. The risk described here applies to unpatched kernels in the affected line, not automatically to every system using the named distribution today.

What went wrong

io_poll_get_ownership() compared the packed poll_refs value as a signed number. IO_POLL_CANCEL_FLAG uses bit 31, so cancellation changed the sign and let subsequent increments bypass the slow path until the reference portion wrapped.

Exploit

Because the issue and its fixes are public, NebuSec’s validation code is included here for reproducibility. The preview starts at the program entry point and shows exactly 15 lines. Expanding it reveals the complete selected C file embedded in this page; build files, headers, helpers, and any additional sources remain in the linked CyberMeowfia directory.

890
}
891

892
int main(int argc, char **argv)
893
{
894
  const uint64_t target_tag = NEBUSEC_TAG;
895
  uint64_t wakeups = argc > 1 ? strtoull(argv[1], NULL, 0) :
896
         (1ULL << 30) - 1;
897
  unsigned workers = argc > 2 ? strtoul(argv[2], NULL, 0) : 1;
898
  bool direct = argc <= 3 || !strcmp(argv[3], "direct");
899
  bool sqpoll = argc > 3 && !strcmp(argv[3], "sqpoll");
900
  bool preflight = argc > 3 && !strcmp(argv[3], "preflight");
901
  bool exploit = argc <= 4 || !strcmp(argv[4], "exploit");
902
  struct ring target, *producers;
903
  int event_fd, ready[2], resumed[2], status;
904
  uint64_t one = 1;

Patch

Fixed upstream in April 2026. The fix treats the packed counter and cancellation state without the unsafe signed comparison. Systems should consume their distribution’s kernel update; disabling or restricting io_uring is only a temporary defense for hosts that cannot patch.

The safest check is the distribution’s own kernel changelog for CVE-2026-52933; version numbers alone can be misleading because vendors routinely backport security fixes without changing to the newest upstream kernel.