CVE-2021-46942

What it actually does

Race condition in io_uring sqpoll cancellation causes per-task counters to overcount inflight requests across shared contexts, making io_uring_cancel_sqpoll sleep indefinitely waiting for events that never arrive.

Why it matters to the business

Applications relying on io_uring with shared submission queue poll threads can experience kernel task hangs lasting minutes, leading to application unresponsiveness or requiring system reboots; urgency is low given age and lack of known exploitation.

How an attack unfolds

An attacker with local access crafts io_uring workloads that register multiple contexts sharing an sqpoll thread, then triggers cancellation paths (via task work or sq_thread exit) so the flawed per-task counting logic deadlocks the sqpoll thread.

How to fix it

Upgrade the Linux kernel to a version containing the upstream fix for io_uring shared sqpoll cancellation; rebuild and reboot if using custom kernels; no backports or configuration workarounds are documented.

How to confirm the fix worked

Confirm the running kernel contains commit resolving io_uring_cancel_sqpoll to iterate all shared ctxs with shared counters; test by exercising multi-ring sqpoll workloads and verifying no 120-second task blocking messages appear in dmesg.

Typical attack path

1. Obtain local execution on a Linux system running an affected kernel
2. Create multiple io_uring rings that share a single sqpoll thread
3. Submit requests and force cancellation via ring exit or explicit cancel
4. Observe sqpoll thread entering uninterruptible sleep due to mismatched counters

How to detect it

Search kernel logs for repeated 'blocked for more than 120 seconds' messages referencing io_uring_cancel_sqpoll or io_sq_thread; inspect task states of iou-sqp-* threads via /proc or crash dumps for uninterruptible sleep during cancellation.

What your security team should do

• Prioritize kernel updates on systems with heavy io_uring usage (databases, high-performance networking, storage)
• Monitor EPSS and KEV status for any future rise in exploit activity
• Audit custom io_uring code for shared sqpoll usage patterns until patches are applied