Linux kernel io_uring: per-task restrictions are freed across exec, so post-exec rings are unrestricted

Impact

Per-task io_uring restrictions are meant to apply to every ring a task creates. The exec cancellation path called __io_uring_free(), which released the restriction along with the task context, so any ring created after an exec ran with no restrictions at all. Where io_uring restrictions are part of a sandbox or runtime confinement around tenant workloads, a local process can shed that confinement simply by exec'ing and opening a new ring. The CVSS vector records a scope change, consistent with escaping the confinement boundary rather than just corrupting state inside it. The practical footprint depends on whether io_uring is enabled for tenant workloads on your nodes - many GPU clusters disable io_uring outright for untrusted pods, which removes this entirely.

Who can reach it

Local, unprivileged user or container process that is allowed to call io_uring_setup. No authentication beyond code execution on the node; not reachable over the network.

What to do

Pick up a stable kernel containing the fix (commits bc0e8faf90e7 and fcef9325afee); no fixed release number is stated in the record, so check your vendor kernel's changelog. Applying it means installing a kernel and rebooting - drain the node's GPU workloads first, since this cannot be hot-patched into a running io_uring implementation. Interim mitigation on multi-tenant nodes is to block io_uring for untrusted workloads (seccomp profile or kernel.io_uring_disabled), which is cheap and needs no reboot.

References

Related entries

• Intel Data Center GPU driver for VMware ESXi (out-of-bounds read): Out-of-bounds read in the ESXi GPU driver exposingCVE-2026-20751 · Intel Data Center GPU driver for VMware ESXi (out-of-bounds read)High
• Intel Data Center GPU driver for VMware ESXi (out-of-bounds write): Out-of-bounds write in the ESXi GPU driver causingCVE-2026-20879 · Intel Data Center GPU driver for VMware ESXi (out-of-bounds write)High
• Xen PCI passthrough on Intel VT-d chipsets without interrupt remapping: The founding GPU-passthrough escape. A guestCVE-2011-1898 · Xen PCI passthrough on Intel VT-d chipsets without interrupt remappingHigh
• Xen libxl (xenlight) PCI passthrough device setup: The toolstack hands a bus-mastering-capable PCI device to an HVMCVE-2013-4329 · Xen libxl (xenlight) PCI passthrough device setupHigh
• Xen Intel VT-d IOMMU page-table handling for PCI passthrough: An inverted boolean means Xen clears a present IOMMUCVE-2013-6375 · Xen Intel VT-d IOMMU page-table handling for PCI passthroughHigh
• QEMU xen_pt PCI passthrough config-space mediation (Xen 3.3.x-4.5.x): The device model failed to mediate guest writesCVE-2015-4106 · QEMU xen_pt PCI passthrough config-space mediation (Xen 3.3.x-4.5.x)High