CVE-2023-52914

What it actually does

Failure to hash a ready io_uring poll request that cannot complete inline causes the request to become unreachable, resulting in a kernel memory leak that prevents proper cleanup and stalls ring exit.

Why it matters to the business

Systems running affected Linux kernels may experience resource exhaustion and hangs during shutdown or ring teardown, increasing operational downtime risk for workloads using io_uring; the issue affects a broad set of stable kernels with no known active exploitation.

How an attack unfolds

An attacker with local access crafts io_uring poll operations that become ready but cannot finish inline; without the missing hash the kernel loses the request reference, accumulating leaks until ring exit is blocked.

How to fix it

Apply the fix from commit 4ad6c063541665c407d17e1faf2fe4f04e947dcc in the Linux kernel; for Android Bluetooth packages update to versions released on or after 2021-07-01 for Android 8.1, 9, 10, and 11.

How to confirm the fix worked

Confirm the running kernel contains commit 4ad6c063541665c407d17e1faf2fe4f04e947dcc or later equivalent; verify io_uring poll paths no longer drop requests by reviewing source or testing ring creation and exit under load.

Typical attack path

1. Obtain local execution on a system using io_uring
2. Submit poll requests via io_uring that are immediately ready
3. Force conditions where inline completion is not possible
4. Trigger repeated operations to accumulate leaked requests
5. Initiate ring exit to observe stall or resource exhaustion

How to detect it

Review kernel logs for io_uring request accounting warnings or stalls during process exit; inspect for repeated creation of poll rings without corresponding completions in system call traces.

What your security team should do

• Prioritize kernel updates on all systems exposing io_uring to untrusted local processes
• Audit workloads for io_uring usage and apply the fixed commit or distribution backport
• Monitor for unusual io_uring-related stalls during application shutdown as an interim indicator