CVE-2021-47504

What it actually does

Race condition in io_uring cancellation logic that prevents task_work from being processed after a successful cancel, leaving the kernel thread in uninterruptible sleep.

Why it matters to the business

Applications relying on io_uring may trigger kernel warnings or become unresponsive, increasing operational overhead and risk of service degradation on affected Linux systems.

How an attack unfolds

An attacker or local process issues io_uring operations that are canceled while pending task_work; the kernel fails to run the task_work during cancellation, stalling progress and surfacing an uninterruptible sleep warning.

How to fix it

Upgrade to a Linux kernel version containing the fix that ensures task_work execution during io_uring cancellations; apply the patch referenced in the commit that corrects the IFF/IIF comment and adds the required task_work handling.

How to confirm the fix worked

Confirm the kernel source contains the updated io_uring_cancel_generic logic that explicitly runs task_work after successful cancellation; test with workloads that exercise io_uring cancel paths and verify absence of uninterruptible sleep warnings.

Typical attack path

1. Submit io_uring work items that require task_work for completion
2. Trigger cancellation of those items via io_uring_cancel_generic
3. Observe kernel thread entering uninterruptible sleep without processing task_work

How to detect it

Review kernel logs for messages indicating uninterruptible sleep in io_uring_cancel_generic; inspect io_uring usage patterns in applications for repeated cancel operations.

What your security team should do

• Prioritize kernel updates on systems using io_uring for high-throughput I/O
• Monitor kernel logs for uninterruptible sleep warnings related to io_uring
• Limit untrusted local access to io_uring interfaces until patched