In the Linux kernel, the following vulnerability has been resolved:
io_uring/poll: correctly handle io_poll_add() return value on update
When the core of io_uring was updated to handle completions
consistently and with fixed return codes, the POLL_REMOVE opcode
with updates got slightly broken. If a POLL_ADD is pending and
then POLL_REMOVE is used to update the events of that request, if that
update causes the POLL_ADD to now trigger, then that completion is lost
and a CQE is never posted.
Additionally, ensure that if an update does cause an existing POLL_ADD
to complete, that the completion value isn't always overwritten with
-ECANCELED. For that case, whatever io_poll_add() set the value to
should just be retained.
CVSS
No CVSS.
References
Configurations
No configuration.
History
No history.
Information
Published : 2026-01-23 15:16
Updated : 2026-01-26 15:03
NVD link : CVE-2025-71149
Mitre link : CVE-2025-71149
CVE.ORG link : CVE-2025-71149
JSON object : View
Products Affected
No product.
CWE
No CWE.