Technical impact
This vulnerability involves the io_uring interface in the Linux kernel. A ring created with the IORING_SETUP_R_DISABLED flag is initially exempt from per‑task register restrictions until it is enabled, allowing a user who can register opcodes to bypass those limits. By first registering any opcode on such a disabled ring and then enabling it with IORING_REGISTER_ENABLE_RINGS, a user can exercise operations that the original task is not authorized for. The flaw therefore permits a privilege escalation within the kernel, as the user can gain access to privileged opcodes beyond the task’s intended restrictions.
Affected Systems
Affecting all Linux kernel builds that contain the vulnerable io_uring implementation. No specific kernel version numbers are listed in the advisory, so any system using the kernel's io_uring support prior to the bugfix commit may be vulnerable. The advisory lists the Linux kernel as the affected product and the CPE indicates the kernel of Linux.
Risk and Exploitability
The CVSS score of 3.3 indicates low overall severity, and the EPSS score of < 1% shows a very low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting there are no publicly known active exploits. The attack relies on local execution: a user with permission to register opcodes can create a disabled io_uring ring, register any opcode, and enable the ring. Because the ring inherits task restrictions, the exploit circumvents per‑task limits and elevates privilege within the kernel, but remains bound to the user’s local environment. The likely attack vector is local execution by a task with permission to register opcodes, as inferred from the description.
Ubuntu USN