The kernel code that manages io_uring cancellation can cause a task to spin when it cannot run pending work. By creating a disabled ring, moving it to another thread, and exiting while a request remains in flight, the exiting thread never sleeps, consumes CPU until the helper thread runs or dies, and when panic_on_warn is enabled the kernel will panic. The outcome is a local denial of service that exhausts CPU resources or crashes the system.

This flaw affects all Linux kernel builds that include the io_uring subsystem prior to the patch committed by commit 3005459e0ddfcef0f555b6e81f672f2c49a1c0aa. Any Linux system where unprivileged users can instantiate io_uring rings, including recent distributions running v5.10 and newer, is potentially vulnerable.

The vulnerability is local and requires a user with permission to create io_uring instances, which is typically granted to all users. No public exploit is known and EPSS data is not available, but the severity could be high because it can trigger a kernel panic. The KEV catalog does not list this CVE. Because the issue involves a busy loop that can lead to a panic, the exploitation probability is low to moderate, yet a vulnerable system cannot tolerate any exploitation attempts.