CVE-2024-56709

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The vulnerability is reached purely through the io_uring syscall interface (io_uring_setup/io_uring_enter, SQE submission, and close(2) of the ring fd), which requires local access to the machine. Per kernel scoring guidance io_uring bugs are Local.

AC:LAttack complexity, low

The attacker controls both sides of the race — they choose exactly when to close the DEFER_TASKRUN ring (driving the request into the PF_KTHREAD fallback worker) and when to exit the submitting task (driving io_wq_put_and_exit/kfree), and can retry the whole sequence in a fresh process arbitrarily many times. The NULL-io_wq/BUG_ON variant is essentially deterministic once the exit ordering is arranged.

PR:LPrivileges required, low

Any unprivileged local user with default io_uring access can create the ring, submit an IOSQE_ASYNC/IOSQE_IO_DRAIN request (REQ_F_FORCE_ASYNC), and trigger the exit race; no capabilities, root, or user-namespace tricks are required.

UI:NUser interaction, none

The entire sequence is performed by the attacker's own process and threads with no victim action of any kind.

S:UScope, unchanged

The corruption and its consequences are confined to the Linux kernel's own security authority; there is no VM, IOMMU, or sandbox boundary crossed.

C:HConfidentiality impact, high

The freed struct io_wq is read back after kfree (wq->state, wq->acct[], wq->free_list, wq->task, wq->do_work/free_work), so an attacker who reclaims the kmalloc-1k slot obtains a use-after-free read primitive over kernel heap contents, and per guidance a UAF is scored High.

I:HIntegrity impact, high

io_run_cancel() invokes wq->do_work(work) and wq->free_work(work) — indirect calls through function pointers read from the freed, attacker-reclaimable allocation — and io_wq_insert_work() writes list pointers into that freed memory, giving control-flow hijack and write primitives suitable for privilege escalation.

A:HAvailability impact, high

The NULL-io_wq path hits BUG_ON() for a guaranteed kernel oops (full panic with panic_on_oops), and because it fires inside io_fallback_req_func() while holding ctx->uring_lock the mutex is leaked, permanently hanging io_ring_exit_work and any task touching that ring; the UAF variant additionally crashes on freed memory.