This vulnerability involves the io_uring interface in the Linux kernel. A disabled ring created with the IORING_SETUP_R_DISABLED flag mistakenly bypasses per-task registration restrictions until enabled. This allows an attacker who has permission to register opcodes to first register any opcode on a disabled ring and later enable the ring, thereby executing operations that the task is not authorized to use. The bug effectively elevates privileges within the kernel, enabling the attacker to perform actions beyond the scope of their original permissions.

Affecting all Linux kernel builds that contain the vulnerable io_uring implementation. No specific kernel version numbers are listed in the advisory, so any system using the kernel's io_uring support prior to the bugfix commit may be vulnerable. The advisory lists the Linux kernel as the affected product and the CPE indicates the kernel of Linux.

The advisory does not provide a CVSS or EPSS score and the vulnerability is not listed in the CISA KEV catalog, indicating that there are currently no documented public exploits. However, local exploitation is feasible for any user process that can create a disabled io_uring ring. The required steps are straightforward: create a ring with IORING_SETUP_R_DISABLED, use any register opcode, then enable the ring with IORING_REGISTER_ENABLE_RINGS, which will be allowed by the inheriting task even if the opcode is normally disallowed. Because the fix requires a kernel patch, the attacker’s success depends on the kernel version; earlier kernels lack the control, while patched kernels enforce the restriction.