High [CVE-2026-52933] fix signed comparison in io_poll_get_ownership

In the Linux kernel, the following vulnerability has been resolved: io_uring/poll: fix signed comparison in io_poll_get_ownership() io_poll_get_ownership() uses a signed comparison to check whether poll_refs has reached the threshold for the slowpath: if (unlikely(atomic_read(&req->poll_refs) >= IO_POLL_REF_BIAS)) atomic_read() returns int (signed).

When IO_POLL_CANCEL_FLAG (BIT(31)) is set in poll_refs, the value becomes negative in signed arithmetic, so the >= 128 comparison always evaluates to false and the slowpath is never taken.

Fix this by casting the atomic_read() result to unsigned int before the comparison, so that the cancel flag is treated as a large positive value and correctly triggers the slowpath. A logic error exists in the `io_poll_get_ownership()` function due to an incorrect signed comparison.

This flaw prevents the necessary slowpath from being triggered when the `IO_POLL_CANCEL_FLAG` is set, potentially leading to unexpected behavior or resource mismanagement within the kernel. In the default Red Hat Enterprise Linux kernel, io_uring is disabled and cannot be used unless explicitly enabled by an administrator.

It can be enabled by configuring the kernel.io_uring_disabled sysctl parameter to 0 or 1, or through another supported method for configuring sysctl parameters.