Executive brief
A vulnerability was identified in the Linux kernel's io_uring subsystem, which is used for high-performance asynchronous input/output operations. Under specific configurations, a race condition could occur when the system attempts to resize internal data structures while simultaneously processing background tasks. This could potentially allow a local attacker to cause a system crash or gain unauthorized elevated privileges, impacting the overall stability and security of the operating system.
Technical details
A race condition exists in the Linux kernel io_uring component when IORING_SETUP_DEFER_TASKRUN and IORING_SETUP_TASKRUN are enabled. The vulnerability occurs during a ring resize operation (IORING_REGISTER_RESIZE_RINGS) where task work flags (IORING_SQ_TASKRUN) are manipulated. Specifically, a small window exists where the kernel may attempt to write to the sq_flags of the old ring structure after it has been swapped but before it is freed. This is a use-after-free or race-based memory corruption scenario. The fix introduces an RCU-protected pointer (rings_rcu) to ensure the ring structure remains stable during task work flag manipulation. Local attackers can exploit this to cause a denial of service or potentially escalate privileges.
Affected products
- Linux Linux Kernel 6.13 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1 to 7.0-rc3
Timeline
- 2026-03-09: patched: Initial patch authored by Jens Axboe
- 2026-03-20: disclosed: CVE published