In the Linux kernel, a flaw in the io_uring subsystem caused per‑task restrictions that were normally enforced for all rings created by a task to be incorrectly cleared when a task performed an exec. The exec cancellation path called __io_uring_free(), freeing both the task context and the per‑task restriction flag, leaving a ring created after exec unrestricted. This allows the process to bypass previously configured restrictions and potentially read or execute data it should not access, a local privilege escalation.

This issue affects all Linux kernel implementations that include the io_uring interface before the commit that fixed the vulnerability was incorporated. The fix was committed to the mainline kernel, so all kernel versions from the moment the flaw was identified up to the patched release are vulnerable. Any distribution shipping an earlier kernel without the commit is at risk.

The vulnerability is not listed in CISA's KEV catalog and its EPSS score is not available, indicating no large‑scale exploitation has been reported. The flaw provides a local privilege‑escalation path for processes that use io_uring and then execute new binaries, allowing an attacker to bypass enforced restrictions. The fix was introduced by separating the task context cleanup, so the flaw remains vulnerable until the kernel is updated. Administrators should plan to update the kernel promptly.