CVE-2023-52895

What it actually does

In io_uring multishot poll requests, a spurious wakeup caused by a poll race leads to direct reissue of the armed request, leaking ring-provided buffers instead of safely ignoring the wakeup without leaving the waitqueue.

Why it matters to the business

Memory leaks in high-throughput I/O paths on Linux systems can cause gradual resource exhaustion, degraded performance, or service instability in environments relying on io_uring for efficient polling.

How an attack unfolds

An attacker triggers a multishot poll request in io_uring, induces a poll race to generate a spurious wakeup, and forces a blunt reissue that leaks buffers; no named threat actors or ransomware campaigns are associated with this issue.

How to fix it

Upgrade the Linux kernel to version 6.1.8 or later, or apply commit 36fc7317cdb16cfeae0f879916995037bb615ac4; for affected Android packages, ensure platform/packages/apps/Settings is updated to the 2021-07-01 fixed builds for versions 8.1 through 11.

How to confirm the fix worked

Verify the running kernel version is at or above the fixed release, confirm the patch is present in the io_uring/poll.c source, and test multishot poll workloads for absence of buffer leaks under race conditions.

Typical attack path

1. Register a multishot poll request via io_uring
2. Trigger conditions that cause a poll race and spurious wakeup
3. Force direct reissue of the multishot request
4. Observe buffer leakage from ring-provided memory

How to detect it

Review kernel logs and io_uring usage traces for repeated multishot poll reissues; monitor memory usage patterns in processes heavily using io_uring; examine for unexpected buffer allocation growth under concurrent poll events.

What your security team should do

• Prioritize kernel upgrades on systems using io_uring for high-performance I/O
• Monitor EPSS and KEV status for any increase in exploit maturity
• Audit applications for io_uring multishot poll usage and apply mitigations if patching is delayed
• Include kernel version checks in vulnerability scanning pipelines