Database/Kernel, userspace & hypervisor
Linux kernel (io_uring): io_uring fixed-buffer registration gives out-of-bounds access to physical memory
Impact
io_uring fixed-buffer registration gives out-of-bounds access to physical memory - full host compromise from an unprivileged process
Who can reach it
Any tenant process in a container with io_uring enabled
What to do
Livepatchable; otherwise drain + reboot. Strategic answer for a neocloud is to disable io_uring in the default container seccomp profile (kernel.io_uring_disabled=2 on 6.6+)
Fleet impact
How widespread
Very common - io_uring is on by default in modern kernels and is heavily used by high-throughput data loaders on GPU nodes
Cost to remediate
node-reboot - kernel 6.4-rc1+; the practical stopgap is disabling io_uring via sysctl, which degrades storage throughput for training jobs
Why it hits the whole fleet
Out-of-bounds physical-memory access from IORING_REGISTER_BUFFERS gives a low-privilege local user full root; from inside a container with io_uring allowed, that is a host takeover on a shared GPU node
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.