CVE-2023-52903

A MODERATE severity denial of service vulnerability was found in the Linux kernel's io_uring subsystem. When an io_uring instance is configured to use both IOPOLL and SQPOLL, the completion queue ring overflow flush (__io_cqring_overflow_flush()) can be invoked from the CQ waiting path without the required locking, triggering a kernel WARNING and crashing the system. Exploiting this flaw requires local access and the ability to submit I/O through an io_uring ring that uses the IOPOLL and SQPOLL features together, and the consequence is limited to system availability. Red Hat Product Security rates this issue as MODERATE (CVSS 5.3, attack vector local, high attack complexity, privileges required), which differs from the upstream CVE record's IMPORTANT rating (CVSS 7.8) because that score assumes high confidentiality and integrity impacts that are not supported by the technical evidence of a locking error causing a kernel warning and crash; the NIST analysis similarly concludes availability-only impact (CVSS 5.5). Based on Red Hat's assessment, Red Hat Enterprise Linux 6, 7, and 8, Fedora, and Red Hat's hosted OpenShift offerings are not affected by this flaw. The remaining Red Hat Enterprise Linux 9 kernel and kernel-rt affects were delegated to the kernel maintenance team, whose assessment resolved them as not affected.