CVE-2024-40922

What it actually does

The flaw allows io_rsrc_ref_quiesce to acquire a mutex while the task state is not TASK_RUNNING after io_run_task_work_sig fails to restore state, violating scheduler invariants and triggering warnings or scheduling corruption in io_uring resource registration paths.

Why it matters to the business

Systems using io_uring for high-performance I/O may experience kernel warnings, instability, or crashes during buffer registration or unregistration under load, increasing operational risk for Linux workloads that rely on this interface.

How an attack unfolds

An attacker with local access triggers repeated io_uring register/unregister operations that invoke io_sqe_buffers_unregister while a signal or task work interrupts the wait loop, leaving the task state incorrect and causing the mutex acquisition to violate scheduler rules.

How to fix it

Update the Linux kernel to a version containing commit 0c9df3df0c888d9ec8d11a68474a4aa04d371cff or later; rebuild and deploy the fixed kernel across all affected systems.

How to confirm the fix worked

Confirm the running kernel includes commit 0c9df3df0c888d9ec8d11a68474a4aa04d371cff by checking git log or kernel version strings; exercise io_uring register paths under load and verify absence of __might_sleep warnings in dmesg.

Typical attack path

1. Obtain local execution context on an affected Linux kernel
2. Open an io_uring instance and register buffers or files
3. Trigger signal delivery or task work during the quiesce wait in io_rsrc_ref_quiesce
4. Cause io_run_task_work_sig to exit without restoring TASK_RUNNING state
5. Invoke blocking mutex operations while !TASK_RUNNING

How to detect it

Review kernel logs for __might_sleep warnings originating from io_rsrc_ref_quiesce or mutex acquisition paths during io_uring register calls; correlate with process activity involving io_uring syscalls.

What your security team should do

• Prioritize kernel upgrade to the fixed commit on all production systems using io_uring
• Audit workloads for io_uring usage and apply compensating controls such as seccomp filters limiting io_uring syscalls until patched
• Monitor kernel logs for scheduler warnings related to io_rsrc_ref_quiesce
• Test patched kernels in staging environments before broad rollout