Executive brief
A vulnerability was identified in the Linux kernel's io_uring subsystem, which is used for high-performance asynchronous input/output operations. A race condition in how the system handles process waiting could allow a local attacker to cause system instability or potentially gain unauthorized elevated privileges. This issue affects systems running Linux kernel versions 6.7 and newer, and has been resolved in recent maintenance updates.
Technical details
A race condition exists in io_uring/waitid.c within the io_waitid_wait() function. The vulnerability stems from the kernel failing to prune a wait queue entry if a cancellation was already in progress during a successful return. This oversight allows a race between the wait queue entry callback and other invocations, potentially leading to use-after-free or list corruption scenarios. The fix ensures that list_del_init(&wait->entry) is called regardless of the cancellation status. The vulnerability was introduced in the IORING_OP_WAITID support (commit f31ecf671ddc) and affects kernels from version 6.7 onwards. Patches are available in stable kernel branches 6.12.y and 6.17.y.
Affected products
- Linux Linux Kernel 6.7 to 6.12.52, 6.17.2
Timeline
- 2025-10-07: patched: Initial fix commit by Jens Axboe
- 2025-10-28: disclosed: CVE published