CVE-2026-53321: Linux io_uring NAPI Busy-Poll Denial of Service

Technical summary

In the Linux kernel's io_uring implementation, the NAPI busy-poll code path lacks a ceiling on busy_poll_to, the maximum duration allowed to poll for network events when none are immediately available. The polling loop performs no conditional rescheduling, meaning a task can hold the CPU indefinitely without reaching a preemption point. This violates kernel scheduler assumptions and can trigger 'task stuck' warnings. The vulnerability is resolved by introducing a 10-millisecond cap on the total poll duration, ensuring regular opportunities for context switching while maintaining the performance benefits of busy-polling for low-latency network I/O workloads.

Business impact

For organizations running latency-sensitive workloads on Linux with io_uring and NAPI enabled, this vulnerability can cause unpredictable system hangs, application timeouts, and kernel warnings that degrade reliability. Database servers, financial trading systems, and real-time analytics platforms relying on kernel bypass networking may experience denial-of-service conditions if untrusted code triggers excessive busy-polling. The impact is confined to systems where io_uring is actively used with network polling, which is not enabled by default in most distributions, reducing exposure but increasing severity for adopters of high-performance I/O patterns.

Affected systems

Linux kernel systems with io_uring support and network polling enabled. Exposure is primarily limited to systems where applications explicitly use io_uring for network I/O and enable NAPI polling. This includes high-performance database engines, custom networking applications, and systems using io_uring-aware libraries. Standard workloads using traditional syscalls are not affected. Exposure depends on kernel version, configuration, and active io_uring usage; most general-purpose Linux distributions in default configuration are at lower risk.

Exploitability

The vulnerability requires local access and the ability to execute code with unprivileged permissions—no special privilege escalation is needed. An unprivileged user can invoke io_uring with network polling to trigger the condition. However, exploitation requires knowledge of io_uring APIs and deliberate intent to stall the scheduler; accidental triggers are unlikely. The flaw does not enable privilege escalation or data exfiltration, only denial of service to system responsiveness. There is no remote attack vector.

Remediation

Apply a Linux kernel update that includes the fix capping busy_poll_to to 10 milliseconds. Verify the patch level against your distribution's advisory. For interim mitigation on systems where io_uring is not essential, disable io_uring at compile time or via kernel parameters. Review application code for unnecessary use of io_uring network polling, and ensure workload isolation prevents untrusted code from accessing io_uring interfaces.

Patch guidance

Monitor your Linux distribution's security advisory for the specific kernel version update containing this fix. Verify the patch details against the vendor advisory to confirm the busy_poll_to cap is included. Test the patched kernel in a staging environment to ensure compatibility with your io_uring workloads before production deployment. If your distribution has not yet released a patched kernel, contact your vendor's support for an estimated timeline.

Detection guidance

Monitor kernel logs for 'task stuck' warnings, 'RCU stalls', or 'NMI watchdog' messages correlated with io_uring activity. Use tools such as bpftrace or perf to profile CPU time spent in io_uring NAPI polling loops. Watch for unexplained latency spikes or missed scheduler deadlines on systems running io_uring-heavy workloads. Implement per-process CPU accounting to identify tasks consuming excessive time without yielding.

Why prioritize this

This is a medium-severity denial-of-service vulnerability affecting local attack surface. It ranks below critical or high-severity flaws but warrants timely patching for organizations running latency-critical or multi-tenant systems where io_uring is used. Prioritize patching for production systems running high-performance database or networking workloads, and for shared infrastructure where untrusted users may execute code.

Risk score, explained

CVSS 3.1 score of 5.5 (Medium) reflects local-only attack vector, unprivileged execution requirement, and denial-of-service impact limited to system responsiveness (no confidentiality or integrity breach). The score appropriately discounts the severity since it does not enable privilege escalation and requires explicit io_uring usage, but it accounts for the potential to degrade availability in affected workloads.

Frequently asked questions