CVE-2026-53321

A flaw was found in the Linux kernel's io_uring subsystem, specifically in the Networked Asynchronous Packet Interface (NAPI) busy polling. This vulnerability allows NAPI to poll indefinitely for events when none are present, which can cause a task to become stuck. This can lead to a Denial of Service (DoS) condition, making the system unresponsive. The issue is addressed by implementing a 10-millisecond cap on the busy polling duration.

This flaw is rated as Moderate impact because exploitation is restricted to local authenticated users, results solely in a denial of service without compromising system confidentiality or integrity, and requires invoking specific io_uring network polling configurations. An unprivileged local attacker can leverage unbounded busy polling loops in the asynchronous I/O framework to starve CPU resources and induce hung task or soft lockup conditions. Enterprise environments running earlier platform releases, such as Red Hat Enterprise Linux 7 and 8, lack this NAPI busy polling feature and are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.