CVE-2023-52654

A security vulnerability was identified in the Linux kernel's io_uring subsystem, specifically related to the handling of file descriptors over UNIX domain sockets. The issue arises from the potential for file reference cycles when io_uring file descriptors are transmitted over sockets using the SCM_RIGHTS mechanism. These cycles can lead to resource leaks and race conditions, particularly with the unix_stream_read_generic() function.

This vulnerability is rated as having a Moderate impact because exploitation requires local system access and is limited to causing a denial of service via kernel race conditions and resource leaks, with no compromise to data integrity or confidentiality. An unprivileged local attacker would need to transmit io_uring file descriptors across UNIX domain sockets to generate circular references. Additionally, supported Red Hat Enterprise Linux releases either omit the affected upstream code or do not provide the io_uring interface.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.