CVE-2025-71149 in Linux
Summary
by MITRE • 01/23/2026
In the Linux kernel, the following vulnerability has been resolved:
io_uring/poll: correctly handle io_poll_add() return value on update
When the core of io_uring was updated to handle completions consistently and with fixed return codes, the POLL_REMOVE opcode with updates got slightly broken. If a POLL_ADD is pending and then POLL_REMOVE is used to update the events of that request, if that update causes the POLL_ADD to now trigger, then that completion is lost and a CQE is never posted.
Additionally, ensure that if an update does cause an existing POLL_ADD to complete, that the completion value isn't always overwritten with -ECANCELED. For that case, whatever io_poll_add() set the value to should just be retained.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/17/2026
The vulnerability CVE-2025-71149 represents a critical flaw in the Linux kernel's io_uring subsystem, specifically within the poll handling mechanism that governs asynchronous I/O operations. This issue affects the io_uring interface which provides high-performance asynchronous I/O capabilities for applications and system components. The flaw manifests in the io_poll_add() function's handling of update operations, where the kernel's internal state management becomes inconsistent during poll request modifications. The vulnerability stems from changes made to the io_uring core to standardize completion handling with fixed return codes, inadvertently breaking the POLL_REMOVE opcode functionality when processing updates to pending POLL_ADD requests.
The technical nature of this vulnerability involves a race condition and state management error within the kernel's asynchronous I/O processing pipeline. When a POLL_ADD operation is pending and subsequently updated through POLL_REMOVE, the system fails to properly handle the scenario where the update causes the originally pending POLL_ADD to immediately trigger. This creates a critical loss of completion events where the kernel fails to post the expected Completion Queue Entry (CQE) to notify applications of the completed poll operation. The flaw specifically impacts the io_uring subsystem's ability to maintain consistent state during concurrent I/O operations and updates, leading to potential application hangs or missed I/O completion notifications.
The operational impact of CVE-2025-71149 extends beyond simple performance degradation to potentially compromise system stability and application reliability. Applications relying on io_uring for high-performance asynchronous I/O operations may experience silent failures where I/O completion events are never delivered, causing applications to wait indefinitely for operations that have actually completed. This vulnerability affects systems using io_uring for database operations, web servers, storage systems, and any high-throughput applications that depend on reliable asynchronous I/O completion handling. The issue particularly impacts environments with high concurrent I/O loads where poll request updates are common, potentially leading to cascading failures in applications that depend on timely I/O completion notifications.
Security implications of this vulnerability align with CWE-362, which addresses concurrent execution use of a resource, and can be mapped to ATT&CK technique T1484.001 for privilege escalation through kernel vulnerabilities. The flaw creates a potential denial-of-service vector where applications may hang indefinitely, and could be exploited by malicious actors to disrupt system services or cause resource exhaustion through repeated triggering of the faulty code path. Additionally, the incorrect handling of completion values with -ECANCELED override can mask legitimate I/O errors, making system diagnostics more difficult and potentially allowing malicious actors to hide their activities through subtle I/O operation failures.
Mitigation strategies should prioritize immediate kernel updates from vendors who have addressed this specific flaw, as the vulnerability exists in the core kernel functionality. System administrators should monitor applications that utilize io_uring for high-performance I/O operations and implement robust error handling to detect and recover from potential I/O completion loss scenarios. The fix involves ensuring proper handling of return values during io_poll_add() updates and maintaining the original completion values when existing POLL_ADD operations complete successfully rather than overwriting them with -ECANCELED. Organizations should also implement comprehensive monitoring for I/O completion patterns and consider alternative I/O mechanisms for critical applications until the kernel patches are fully deployed and validated across their environments.