Linux kernel io_uring: waitid entry left on the wait queue races the callback on cancellation

Impact

io_waitid_wait() skipped removing its entry from the wait queue list when a cancellation was already in progress, which can race a second invocation of the same wait-queue callback. The fix always prunes the entry on a successful return. io_uring is the submission path a lot of modern storage and serving code uses on GPU nodes, and it is reachable by any unprivileged process unless explicitly gated, so a race in its cancellation path is a local integrity concern on a shared node. The record does not describe a demonstrated exploitation path - treat it as a concurrency bug with crash potential rather than an established privilege escalation.

Who can reach it

Local, unprivileged: a process issuing IORING_OP_WAITID and cancelling it concurrently. No authentication beyond a shell or container on the node. Clusters that disable io_uring (seccomp profile, kernel.io_uring_disabled, or a runtime that blocks the syscalls) are not exposed.

What to do

Update to a stable kernel containing the fix (three commits in the record) and reboot the node. As an interim mitigation, io_uring can be restricted or disabled with kernel.io_uring_disabled or a seccomp profile that blocks io_uring_setup - check first whether your serving or storage stack depends on it.

References

Related entries

• Linux kernel vhost vringh: copy helper return values checked for negative instead of short copiesCVE-2025-40051 · Linux kernel vhost vringh (copy_from_iter/copy_to_iter return value check)High
• Linux kernel (net/smc): Connect() on an SMC socket takes the destination device pointer out of the dst cache without aCVE-2025-40064 · Linux kernel (net/smc)High
• Linux kernel arm_spe: integer overflow in PERF_IDX2OFF with AUX buffers of 2 GiB or moreCVE-2025-40081 · Linux kernel perf arm_spe (PERF_IDX2OFF integer overflow)High
• Linux kernel (drivers/gpu/drm/scheduler): When adding reservation-object dependencies to a job, the helper alreadyCVE-2025-40096 · Linux kernel (drivers/gpu/drm/scheduler)High
• Linux kernel (drivers/gpu/drm/vmwgfx): A guest process can get a node left in the vmwgfx validation hash table afterCVE-2025-40111 · Linux kernel (drivers/gpu/drm/vmwgfx)High
• Linux kernel pm80xx: out-of-bounds phy array index when unloading the driver behind a SAS expanderCVE-2025-40118 · Linux kernel scsi pm80xx (phy array index on device teardown)High