CVE-2023-53461

io_uring: wait interruptibly for request completions on exit

published October 1, 2025

CVSS
—
EPSS
0%
Percentile
4.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

io_uring: wait interruptibly for request completions on exit

WHen the ring exits, cleanup is done and the final cancelation and

waiting on completions is done by io_ring_exit_work. That function is

invoked by kworker, which doesn't take any signals. Because of that, it

doesn't really matter if we wait for completions in TASK_INTERRUPTIBLE

or TASK_UNINTERRUPTIBLE state. However, it does matter to the hung task

detection checker!

Normally we expect cancelations and completions to happen rather

quickly. Some test cases, however, will exit the ring and park the

owning task stopped (eg via SIGSTOP). If the owning task needs to run

task_work to complete requests, then io_ring_exit_work won't make any

progress until the task is runnable again. Hence io_ring_exit_work can

trigger the hung task detection, which is particularly problematic if

panic-on-hung-task is enabled.

As the ring exit doesn't take signals to begin with, have it wait

interruptibly rather than uninterruptibly. io_uring has a separate

stuck-exit warning that triggers independently anyway, so we're not

really missing anything by making this switch.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00159 · 4.7th percentile
Published
2025-10-01T11:42Z
EPSS history
Timeline
  • 01 OCT 11:42Z
    io_uring: wait interruptibly for request completions on exit
    cvelistv5