CVE-2024-56709

What it actually does

Race condition in io_uring allows task work to execute after io_wq has been killed and null'ed during ring termination or task exit, causing io_queue_iowq() to dereference a null pointer or attempt invalid queuing.

Why it matters to the business

Potential kernel crashes or denial of service on systems using io_uring for high-performance I/O, increasing operational risk and requiring urgent patching on affected Linux deployments; widespread kernel usage amplifies exposure across servers and containers.

How an attack unfolds

An attacker triggers io_uring termination (via ring close or task kill) while concurrent task work is pending, racing the PF_KTHREAD and iowq null check so that a request reaches the killed io_wq path and triggers undefined behavior or crash.

How to fix it

Update the Linux kernel to commit 534d59ab38010aada88390db65985e65d0de7d9e or later stable releases that include the io_queue_iowq() killed-iowq check; apply vendor kernel packages containing this fix.

How to confirm the fix worked

Confirm kernel version contains commit 534d59ab38010aada88390db65985e65d0de7d9e; inspect io_uring.c for the added iowq-killed and PF_KTHREAD checks before io_queue_iowq(); run io_uring termination stress tests to verify no null dereference occurs.

Typical attack path

1. Create a DEFER_TASKRUN io_uring ring
2. Submit requests that will generate task work
3. Close the ring and immediately kill the task to race termination
4. Trigger fallback task_work execution after iowq is null'ed
5. io_queue_iowq() dereferences killed/null iowq leading to fault or DoS

How to detect it

Review kernel logs for io_uring related oops or null pointer dereference during ring teardown or task exit; look for unexpected crashes in io_queue_iowq paths on systems with recent io_uring activity.

What your security team should do

• Prioritize kernel updates on all systems using io_uring (high-performance storage/network workloads)
• Monitor for upstream stable releases and backports
• Restrict io_uring use via seccomp or LSM where not required until patched
• Test patched kernels in staging before production rollout