CVE-2023-0468

What it actually does

Use-after-free in io_uring/poll.c caused by a race on poll_refs leads to NULL pointer dereference and potential kernel crash.

Why it matters to the business

Local denial-of-service risk on Linux systems that rely on io_uring; older kernels remain exposed after more than three years with public exploits available.

How an attack unfolds

An attacker with local access crafts a sequence of poll operations on io_uring to trigger the race condition, freeing a structure while it is still referenced and causing a NULL dereference that crashes the kernel.

How to fix it

Upgrade the Linux kernel to a version containing commit 830b3c68c1fb1e9176028d02ef86f3cf76aa2476 or later; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Verify the running kernel contains commit 830b3c68c1fb1e9176028d02ef86f3cf76aa2476 via git log or kernel version string; attempt to reproduce the race under controlled conditions to confirm absence of the crash.

Typical attack path

1. Obtain local user access on a vulnerable Linux kernel
2. Open an io_uring instance and register poll operations
3. Trigger concurrent events that race on poll_refs
4. Trigger use-after-free leading to NULL pointer dereference
5. Cause kernel panic or system hang

How to detect it

Search kernel logs and crash dumps for oops messages containing io_poll_check_events or io_uring poll references; review audit logs for unusual io_uring usage patterns around the time of any system instability.

What your security team should do

• Prioritize kernel upgrade on all systems using io_uring
• Disable io_uring via kernel boot parameter or seccomp filter where the feature is not required
• Monitor for kernel oops or panic logs referencing io_poll_check_events
• Apply the fix before any future increase in exploit maturity