{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "a26a35e9019fd70bf3cf647dcfdae87abc7bacea"
            },
            {
              "fixed": "81bf96b0abbfa4cd47ea32e12596aed3855fb2f3"
            },
            {
              "fixed": "cf522703d4f194991615763697ae25a3f9539763"
            },
            {
              "fixed": "fc47043f3d9af3efa407665b47f8378ec691ba18"
            },
            {
              "fixed": "ea0697129807d718037f618221037aa0660ee3c5"
            },
            {
              "fixed": "c6d191164dc81838d8dbf452a6000f68c558d1ae"
            },
            {
              "fixed": "326941b22806cbf2df1fbfe902b7908b368cce42"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "4b702b7d11ce1b9d26fc6d7c5a7ef4ac1d455048"
            },
            {
              "last_affected": "bc4e6ee16778149811333a969a7a893d4cc110c5"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "5.15.82"
            },
            {
              "fixed": "5.16"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.0.11"
            },
            {
              "fixed": "6.1"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.1.0"
            },
            {
              "fixed": "6.1.175"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.2.0"
            },
            {
              "fixed": "6.6.140"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.12.86"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.27"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.0.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52933.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/poll: fix signed comparison in io_poll_get_ownership()\n\nio_poll_get_ownership() uses a signed comparison to check whether\npoll_refs has reached the threshold for the slowpath:\n\n    if (unlikely(atomic_read(\u0026req-\u003epoll_refs) \u003e= IO_POLL_REF_BIAS))\n\natomic_read() returns int (signed). When IO_POLL_CANCEL_FLAG\n(BIT(31)) is set in poll_refs, the value becomes negative in\nsigned arithmetic, so the \u003e= 128 comparison always evaluates to\nfalse and the slowpath is never taken.\n\nFix this by casting the atomic_read() result to unsigned int\nbefore the comparison, so that the cancel flag is treated as a\nlarge positive value and correctly triggers the slowpath.",
  "id": "CVE-2026-52933",
  "modified": "2026-07-15T01:49:05.814033741Z",
  "published": "2026-06-24T07:14:24.678Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/326941b22806cbf2df1fbfe902b7908b368cce42"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/81bf96b0abbfa4cd47ea32e12596aed3855fb2f3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c6d191164dc81838d8dbf452a6000f68c558d1ae"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cf522703d4f194991615763697ae25a3f9539763"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ea0697129807d718037f618221037aa0660ee3c5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fc47043f3d9af3efa407665b47f8378ec691ba18"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52933.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52933"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.8.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "io_uring/poll: fix signed comparison in io_poll_get_ownership()"
}