CVE-2026-80713
Description
A flaw was found in the Linux kernel's io_uring subsystem. When a task that has used io_uring performs an exec call, its per-task restrictions are not properly preserved. This oversight allows a subsequent io_uring ring created by the task to operate without the intended security restrictions, potentially leading to a security bypass.
Statement
A flaw was found in the Linux kernel's io_uring subsystem. When a task that has already used io_uring performs an exec call, the kernel's exec cancellation path frees the task's io_uring context together with its per-task restrictions. As a result, an io_uring ring created by that task after the exec is unrestricted, allowing a local user to bypass the io_uring security restrictions that were installed for the task and perform operations that were intended to be prohibited. Red Hat Product Security has rated this flaw as Moderate (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access with low privileges and the bypass is limited to the io_uring restrictions of the attacking task. This is lower than the upstream CVE.org rating of Important (CVSS 8.4), which reflects a broader confidentiality and integrity impact than Red Hat's assessment. All Red Hat Enterprise Linux 6, 7, 8, 9, and 10 kernel and kernel-rt update streams, as well as the Red Hat In-Vehicle OS kernel streams, are not affected because the vulnerable code is not present in the kernel versions shipped in those products.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 8.4 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Changed |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
