CVE-2023-52903

What it actually does

A race condition in io_uring overflow handling for IOPOLL operations fails to hold the required lock when combined with SQPOLL, allowing the overflow flush path to be reached unsafely during request cancellation and ring teardown, resulting in warnings or potential memory corruption.

Why it matters to the business

Systems using high-performance asynchronous I/O may experience kernel warnings, instability, or crashes that disrupt services and require restarts, with added urgency for organizations running recent kernels that include io_uring features.

How an attack unfolds

An attacker crafts an io_uring instance with both IOPOLL and SQPOLL enabled, submits requests that trigger overflow conditions, then forces cancellation or ring exit to hit the unsafe flush path; no named threat actors or public exploits are known for this issue.

How to fix it

Upgrade the Linux kernel to a version containing commit de77faee280163ff03b7ab64af6c9d779a43d4c4; for Android, ensure platform/system/nfc is at the 2021-05-01 fixed releases for versions 8.1 through 11.

How to confirm the fix worked

Confirm the presence of commit de77faee280163ff03b7ab64af6c9d779a43d4c4 in the running kernel source or binary; reproduce io_uring IOPOLL workloads and verify absence of the io_cqring_event_overflow warning.

Typical attack path

1. Create io_uring ring with IOPOLL | SQPOLL flags
2. Submit I/O requests that cause CQ overflow
3. Trigger io_uring_try_cancel_requests or ring exit
4. Reach __io_cqring_overflow_flush without proper locking

How to detect it

Search kernel logs and dmesg for the string io_cqring_event_overflow+0x1c0; correlate with processes using io_uring rings that have IOPOLL and SQPOLL enabled during cancellation or exit events.

• io_cqring_event_overflow+0x1c0/0x230
• io_req_cqe_overflow+0x5c/0x70
• io_do_iopoll+0x474/0x62c

What your security team should do

• Apply the referenced kernel commit or newer stable release immediately on all affected systems
• Inventory workloads that enable both IOPOLL and SQPOLL in io_uring and prioritize those for patching
• Monitor kernel logs for io_cqring_event_overflow warnings as an interim detection measure