CVE-2021-47123

What it actually does

Use-after-free in io_uring linked timeout handling caused by failure to always remove the timeout from the master request link list on io_link_timeout_fn(), enabling double-free on a completion race.

Why it matters to the business

Affected Linux systems risk kernel crashes, memory corruption, or potential privilege escalation; low EPSS and no KEV listing indicate limited in-the-wild exploitation risk, yet kernel-level impact still requires prompt patching on torque-managed AlmaLinux 8 deployments.

How an attack unfolds

An attacker submits io_uring requests containing linked timeouts, races the first completion path to free the timeout structure, then re-uses the dangling pointer from the master request list to achieve arbitrary memory access or denial of service.

How to fix it

Upgrade torque, torque-devel, and torque-libs on AlmaLinux 8 to version 4.2.10-25.el8 or later; rebuild and redeploy any dependent workloads; verify the running kernel also contains the upstream io_uring linked-timeout fix.

How to confirm the fix worked

Confirm installed package versions match or exceed 4.2.10-25.el8, run regression tests exercising io_uring linked timeouts, and inspect kernel logs for absence of use-after-free warnings under load.

Typical attack path

1. Locate hosts exposing io_uring interfaces or running untrusted workloads that use linked timeouts
2. Submit carefully timed io_uring submissions that trigger io_link_timeout_fn()
3. Force a race between the fail path and the master request free path
4. Reclaim or corrupt the freed object to escalate privileges or crash the kernel

How to detect it

Search kernel logs and audit trails for io_uring timeout-related oops, use-after-free warnings, or unexpected process crashes around io_uring submission/completion paths; correlate with any recent unprivileged process activity using io_uring.

What your security team should do

• Apply the AlmaLinux 8 torque package updates within the next maintenance window
• Disable io_uring via sysctl where not required until patches are deployed
• Add kernel oops monitoring for io_uring symbols to existing alerting
• Review application usage of io_uring linked timeouts for removal or hardening