A high-severity vulnerability in the Linux kernel io_uring subsystem allows local users to bypass security restrictions across exec calls, creating a risk of unauthorized privilege escalation.

The vulnerability exists within the io_uring task context cleanup process. An attacker with local access and low privileges can trigger a condition where per-task security restrictions are incorrectly dropped during an exec operation, leaving subsequent rings unrestricted.

The exploitation of this vulnerability allows a local user to bypass intended security constraints, which could lead to unauthorized access to sensitive system resources or escalation of privileges. Given the CVSS score of 8.4, the risk is categorized as High because it permits a local user to operate outside of security boundaries, potentially compromising the integrity and confidentiality of the entire system.

Immediate Action: Update the Linux kernel to version 7.1.8 or later, as this release includes the necessary patches to properly preserve task restrictions across exec calls.

Proactive Monitoring: Monitor system logs for unusual io_uring activity or unexpected process execution patterns that may indicate an attempt to exploit kernel-level subsystems.

Compensating Controls: Restrict access to the io_uring interface for untrusted users using security modules such as SELinux or AppArmor to limit the scope of potential exploitation.

Public Exploit Available: Unknown

This vulnerability represents a significant risk to the security posture of Linux-based systems due to the potential for security restriction bypass. Administrators must prioritize patching the kernel to version 7.1.8 or later across all affected environments to prevent local attackers from escalating their capabilities. Ongoing kernel maintenance and the application of security-hardened configurations remain critical to mitigating such low-level risks.