Executive brief
Linux systems using io_uring (a high-performance I/O interface) are vulnerable to a privilege escalation attack. When a process with io_uring restrictions executes a new program via exec, those restrictions are incorrectly dropped. An attacker who can execute code in a restricted io_uring process can bypass security controls after exec and gain unauthorized capabilities to perform unrestricted I/O operations.
Technical details
The vulnerability is a logic error in the Linux kernel's io_uring task cleanup path during process execution. Per-task io_uring restrictions are security controls registered via ed82f35b926b that should persist across exec() calls. However, the exec cancellation handler calls __io_uring_free() which unconditionally frees both the task context and per-task restrictions, allowing a newly exec'd process to bypass those restrictions. The fix splits task context cleanup into a separate io_uring_free_tctx() function called during exec cancellation while preserving restrictions, reserving full cleanup for final task teardown. The vulnerability affects Linux 7.1+ kernels and requires the attacker to already have code execution in a process with io_uring restrictions installed.
Affected products
- Linux Linux kernel 7.1 and later
Timeline
- 2026-08-28: disclosed
- 2026-07-30: patched: Upstream fix commit bc0e8faf90e776a2f1f3967a04e8091e6bdb4977
- 2026-08-09: patched: Stable kernel backport commit fcef9325afeecced693a7438e975e4a3f8e2716f