A vulnerability in the Linux kernel io_uring subsystem may allow an authenticated local attacker to achieve elevated privileges or system instability.

The vulnerability exists within the io_waitid_cb function, which fails to honor task_work cancellation requests. An attacker with local access can exploit this by triggering a fallback task_work path, causing the kernel to execute waitid operations in an incorrect task context.

The flaw carries a CVSS score of 7.8, indicating a high severity risk for local environments. Successful exploitation allows a local user to compromise the confidentiality, integrity, and availability of the system. This could lead to unauthorized access to sensitive kernel-level data or a complete system crash, resulting in significant operational downtime.

Immediate Action: Update the Linux kernel to version 7.2.4 or later, or apply the upstream patches provided in the Linux stable git repositories.

Proactive Monitoring: Monitor system logs for unexpected kernel oops or crashes associated with io_uring operations.

Compensating Controls: Restrict local access to the system and limit the ability of untrusted users to execute workloads that utilize io_uring functionality.

Public Exploit Available: Unknown

Given the severity of potential kernel-level compromise, administrators should prioritize patching affected Linux distributions as soon as stable updates become available. Organizations running high-density multi-user environments or containerized hosts utilizing io_uring should treat this as a high-priority maintenance task to prevent local privilege escalation.