The flaw in the Linux kernel’s io_uring subsystem results in the accidental removal of per‑task restrictions when a process calls exec. The exec cancellation path mistakenly frees both the task context and its restriction flag, allowing a ring created after exec to operate without the originally applied constraints. This potentially permits a process to perform actions that were intended to be disallowed, which could lead to local privilege escalation. Based on the available information, this effect is inferred rather than explicitly documented in the advisory.

All Linux kernel versions that expose the io_uring interface before the commit which applied the fix are affected. Distributions shipping such kernels are susceptible. Kernel releases later than the patch commit are considered fixed.

The vulnerability carries a CVSS score of 8.4, reflecting high severity, but its EPSS score is reported as <1% and it is not listed in CISA’s KEV catalog, indicating limited observation of exploitation. The likely attack vector is local: an attacker who can run io_uring and subsequently invoke exec may exploit the cleared restrictions. The exploit requires local access to the affected system and the ability to execute code via io_uring.