In the Linux kernel, a race condition in the io_uring timeout subsystem causes a cancellation request to be ignored when a work queue arms a timeout. This defect lets the operation that issued the timeout stay blocked for the full timeout duration, effectively suspending the task and potentially exhausting system resources. The flaw is a classic concurrency bug that undermines the integrity of asynchronous I/O handling. The issue was identified in the kernel's handling of IOSQE_ASYNC and io_try_cancel interactions.

All Linux kernel releases are affected; no specific version numbers are listed. The problem manifests when io_uring is used on a system running a vulnerable kernel, regardless of distribution.

No publicly documented CVSS or EPSS metrics, and the vulnerability is not listed in the CISA KEV catalog, indicating limited exposure data. The likely attack vector is local to a user with permission to submit io_uring requests and issue cancellations – this inference is drawn from the description of the race condition involving io_wq_submit_work and io_try_cancel. An attacker could exploit the timing condition to keep a task blocked for the entirety of a timeout interval, leading to denial of service on the local machine. The risk remains moderate to high for environments where io_uring is enabled and no mitigation has been applied.