In the Linux kernel, the following vulnerability has been resolved:
io_uring/poll: correctly handle io_poll_add() return value on update
When the core of io_uring was updated to handle completions
consistently and with fixed return codes, the POLL_REMOVE opcode
with updates got slightly broken. If a POLL_ADD is pending and
then POLL_REMOVE is used to update the events of that request, if that
update causes the POLL_ADD to now trigger, then that completion is lost
and a CQE is never posted.
Additionally, ensure that if an update does cause an existing POLL_ADD
to complete, that the completion value isn't always overwritten with
-ECANCELED. For that case, whatever io_poll_add() set the value to
should just be retained.
References
Configurations
Configuration 1 (hide)
|
History
26 Feb 2026, 20:28
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/0126560370ed5217958b85657b590ad25e8b9c00 - Patch | |
| References | () https://git.kernel.org/stable/c/13a8f7b88c2d40c6b33f6216190478dda95d385f - Patch | |
| References | () https://git.kernel.org/stable/c/84230ad2d2afbf0c44c32967e525c0ad92e26b4e - Patch | |
| References | () https://git.kernel.org/stable/c/8b777ab48441b153502772ecfc78c107d4353f29 - Patch | |
| References | () https://git.kernel.org/stable/c/c1669c03bfbc2a9b5ebff4428eecebe734c646fe - Patch | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| CWE | NVD-CWE-noinfo | |
| First Time |
Linux
Linux linux Kernel |
|
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
23 Jan 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-23 15:16
Updated : 2026-02-26 20:28
NVD link : CVE-2025-71149
Mitre link : CVE-2025-71149
CVE.ORG link : CVE-2025-71149
JSON object : View
Products Affected
linux
- linux_kernel
CWE