CVE-2026-80713: io_uring: preserve task restrictions across exec
In the Linux kernel, the following vulnerability has been resolved:
iouring: preserve task restrictions across exec
Per-task restrictions apply to all rings created by a task. Once installed, they should not be dropped across exec.
For a task that has used iouring, the exec cancellation path calls iouringfree(). This frees both the task context and the per-task restriction, so a ring created after exec is unrestricted.
Split task context cleanup into iouringfreetctx(), and use it from the exec cancellation path. Keep iouringfree() for final task cleanup, where both the context and restriction are released.
Event History
Frequently Asked Questions
What conditions are required for this issue to affect a task?
The task must have used io_uring and have per-task restrictions installed. It must then execute a new program via exec and create an io_uring ring after that exec.
What is the security impact after the affected exec path?
The exec cancellation path can free the task's per-task restriction along with its io_uring task context. A ring created after exec can therefore be unrestricted even though restrictions had previously been installed for that task.
How can I tell whether a workload may have encountered the issue?
Review workloads that install io_uring per-task restrictions, subsequently call exec, and then create another io_uring ring. That sequence is the affected path described by the fix.
What behavior does the fix change?
The fix separates io_uring task-context cleanup from final task cleanup. During exec, it frees the task context but retains the per-task restriction; both are released only during final task cleanup.