← CVE announcements

SECURITY ANNOUNCEMENT

CVE-2026-99267

3 November 2026

With dynamic tracking a NAPI id that hasn't been seen for a minute is meant to be dropped from the list the ring busy polls. The timeout is added to jiffies, but it is defined as 60 * SEC_CONVERSION, and SEC_CONVERSION isn't the number of jiffies in a second. It is the internal factor of __timespec64_to_jiffies(), HZ scaled up by SEC_JIFFIE_SC bits. For HZ=1000 that is 1000 << 22, which puts the timeout at about eight years. On 32-bit the multiplication overflows.

So entries are never removed, and every id that a socket of the ring ever had keeps being polled on each wait.

Introduced

6.9 8d0c12a80cdeb80d5e0510e96d38fe551ed8e9b5

Fixed releases

6.12.115 3fe820cf35f83534eab72ea73f1a83cfd3cd8079

6.18.60 18c373f446068972788158c8c7de6e849b04ed98

7.2.14 981621d6eadcd232d4ea748aaeb046337f10d3c1

View source announcement ↗