io_uring Poll Wakeup Loss in Linux Kernel

Executive Summary

This vulnerability in the Linux kernel involves a race condition in the io_uring/poll mechanism. When a wakeup sets the IO_POLL_RETRY_FLAG between the owning task processing an existing instance and checking for new events, the request stalls until an unrelated wakeup occurs. The fix uses atomic_cmpxchg instead of atomic_sub_return to ensure both the count and poll_refs are zero and no wakeups are missed.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to the Linux kernel's io_uring/poll functionality. Detection requires checking the kernel version and io_uring implementation. Use 'uname -a' to check the kernel version and 'grep IO_POLL_RETRY_FLAG /proc/kallsyms' to inspect io_uring symbols. If the kernel is vulnerable, patching is required.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could lead to stalled I/O operations in systems using the Linux kernel's io_uring feature. If exploited, it may cause delays or hangs in processing I/O requests, potentially affecting system performance or responsiveness.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Linux kernel to a patched version that resolves this issue. Check your distribution's security advisories for kernel updates. If immediate patching is not possible, consider disabling io_uring features temporarily as a workaround.

Useful 0 Not Useful 0