CVE-2021-47569

What it actually does

Race condition in io_uring cancellation logic that fails to handle EXITING tasks correctly, causing io_try_cancel_userdata to trigger warnings or undefined behavior when fallback request processing occurs outside the original task context.

Why it matters to the business

Kernel instability or crashes on Linux systems that use io_uring under workloads involving rapid task termination, increasing operational risk in high-throughput I/O environments despite low observed exploitation rates.

How an attack unfolds

An attacker triggers io_uring operations followed by immediate task exit so that cancellation callbacks run in the fallback workqueue path, where the missing original task context leads to failed or unsafe cancellation attempts.

How to fix it

Upgrade to a Linux kernel containing the fix for io_uring task-exit cancellation handling; apply the patch that fails cancellation attempts for EXITING tasks when executed in fallback mode.

How to confirm the fix worked

Confirm kernel version includes the upstream commit resolving io_try_cancel_userdata for EXITING tasks; reproduce the original syzkaller reproducer and verify absence of the WARNING at fs/io_uring.c:6269.

Typical attack path

1. Create io_uring instance and submit requests that can be cancelled
2. Force rapid task exit while cancellation is pending
3. Trigger fallback request processing path
4. Observe or induce kernel warning/crash from io_try_cancel_userdata

How to detect it

Search kernel logs for WARNING at fs/io_uring.c:6269 or stack traces involving io_req_task_link_timeout and io_fallback_req_func; inspect for repeated io_uring cancellation attempts during process exit events.

• WARNING: CPU:.*io_try_cancel_userdata
• io_req_task_link_timeout+0x6b/0x1e0 fs/io_uring.c
• io_fallback_req_func+0xf9/0x1ae fs/io_uring.c

What your security team should do

• Prioritize kernel upgrades on systems with heavy io_uring usage
• Monitor for kernel warnings referencing io_try_cancel_userdata
• Limit untrusted local code execution until patched