UBUNTU-CVE-2026-80713: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: iouring: preserve task restrictions across exec Per-task restrictions apply to all rings created by a task. Once installed, they should not be dropped across exec. For a task that has used iouring, the exec cancellation path calls iouringfree(). This frees both the task context and the per-task restriction, so a ring created after exec is unrestricted. Split task context cleanup into iouringfreetctx(), and use it from the exec cancellation path. Keep iouringfree() for final task cleanup, where both the context and restriction are released.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Who can exploit this issue?
A local attacker with low privileges who can use io_uring is required. The issue applies when per-task io_uring restrictions have been installed for a task.
What does an attacker need to do to bypass the restriction?
The affected task must have used io_uring and then execute a new program image with exec. The exec cancellation path can release the per-task restriction, allowing a ring created after exec to be unrestricted.
Are systems affected by default?
The issue depends on use of io_uring per-task restrictions; the provided information does not establish that the vulnerable condition is present in a default configuration.
How can I determine whether a workload is exposed?
Review workloads that install per-task io_uring restrictions and subsequently call exec before creating another io_uring ring. Such a sequence may result in the post-exec ring operating without the intended restriction.