During the installation of both ends of a pipe in the fixed file table, the io_pipe_fixed function releases the uring lock. If the handling of the slot numbers faults, the function reacquires the lock and removes whatever is in these slots. Because the lock was dropped, other io_uring requests can close or reuse the slots in the meantime. The flaw allows an attacker to trigger a race that results in the removal of unrelated file descriptors, leading to application crashes, data loss, or denial‑of‑service conditions. The weakness is a classic concurrency race that violates atomicity of shared data structures.

All Linux kernel releases that include the io_uring subsystem and the buggy io_pipe_fixed implementation are affected. The exact kernel versions are not listed in the advisory, so any deployment with io_uring support until the patch is applied is potentially vulnerable.

The advisory does not provide a CVSS score or EPSS value. The vulnerability is not currently listed in the CISA KEV catalog, suggesting no publicly known exploits yet. Attackers would likely need local or elevated privileges to orchestrate the concurrent io_uring operations required to trigger the race, but the lack of a lock makes exploitation comparatively easier than with a fully serialized implementation. Given the potential for arbitrary descriptor loss and subsequent denial of service, the risk is considered high for systems exposing io_uring APIs.