CVE-2023-1295

What it actually does

A race condition in the io_uring IORING_OP_CLOSE operation permits a local process to alter file descriptor state between the check and use phases, enabling unauthorized elevation to root privileges.

Why it matters to the business

Local users on affected Linux systems can obtain full administrative control, risking complete system compromise, data exposure, and disruption of services; the issue has been public for years with negligible observed exploitation activity.

How an attack unfolds

An attacker with an existing local account on a vulnerable kernel prepares a program that repeatedly triggers the close operation race to corrupt kernel structures and execute code with root privileges.

How to fix it

Upgrade the Linux kernel to a version containing commit 9eac1904d3364254d622bf2c771c4f85cd435fc2 or any later backport that resolves the race condition.

How to confirm the fix worked

Confirm the running kernel is newer than 5.11 or contains the listed fix commit; test that io_uring close operations no longer permit descriptor reuse after closure.

Typical attack path

1. Gain an initial local shell on the target system
2. Execute or compile exploit code that races the IORING_OP_CLOSE operation
3. Obtain root shell after successful race win
4. Install persistence or move laterally within the host

How to detect it

Inspect kernel audit logs and dmesg output for repeated io_uring close failures or unexpected file descriptor reuse patterns; correlate with processes that heavily exercise the io_uring interface.

What your security team should do

• Apply the kernel fix or upgrade to a supported distribution release containing the patch
• Limit local user accounts and privileges on systems that cannot be immediately updated
• Review kernel logs for anomalous io_uring activity after patching