A race condition exists in the Linux kernel io_uring subsystem that may cause the IORING_SQ_TASKRUN flag to be incorrectly applied while a ring buffer is being resized. During the brief window when the old rings are freed and replacement rings are swapped in, the task work flags manipulation can corrupt memory or cause a kernel crash. The vulnerable behavior does not directly grant an attacker code execution, but a crash could allow a local privileged attacker to gain escalated privileges or disrupt system availability.

All Linux kernel distributions are potentially affected when the affected kernel version implements the io_uring feature set described. No specific kernel release versions are listed in the available data, so any kernel that includes io_uring support prior to the fix should be considered vulnerable.

The CVSS score of 7.8 indicates a high severity vulnerability, and the low EPSS (<1%) suggests exploitation is unlikely in the wild. The vulnerability is not currently listed in the CISA KEV catalog. The attack vector is local to the kernel, requiring the attacker to execute privileged code that can manipulate task work or trigger a ring resize. Because the issue is tied to kernel memory management, exploitation would be relatively complex and is not known to be actively weaponized.