CVE-2026-52933

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> io_uring/poll: fix signed comparison in io_poll_get_ownership()<br /> <br /> io_poll_get_ownership() uses a signed comparison to check whether<br /> poll_refs has reached the threshold for the slowpath:<br /> <br /> if (unlikely(atomic_read(&amp;req-&gt;poll_refs) &gt;= IO_POLL_REF_BIAS))<br /> <br /> atomic_read() returns int (signed). When IO_POLL_CANCEL_FLAG<br /> (BIT(31)) is set in poll_refs, the value becomes negative in<br /> signed arithmetic, so the &gt;= 128 comparison always evaluates to<br /> false and the slowpath is never taken.<br /> <br /> Fix this by casting the atomic_read() result to unsigned int<br /> before the comparison, so that the cancel flag is treated as a<br /> large positive value and correctly triggers the slowpath.