CVE-2026-80713

A flaw was found in the Linux kernel's io_uring subsystem. When a task that has used io_uring performs an exec call, its per-task restrictions are not properly preserved. This oversight allows a subsequent io_uring ring created by the task to operate without the intended security restrictions, potentially leading to a security bypass.

A flaw was found in the Linux kernel's io_uring subsystem. When a task that has already used io_uring performs an exec call, the kernel's exec cancellation path frees the task's io_uring context together with its per-task restrictions. As a result, an io_uring ring created by that task after the exec is unrestricted, allowing a local user to bypass the io_uring security restrictions that were installed for the task and perform operations that were intended to be prohibited. Red Hat Product Security has rated this flaw as Moderate (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access with low privileges and the bypass is limited to the io_uring restrictions of the attacking task. This is lower than the upstream CVE.org rating of Important (CVSS 8.4), which reflects a broader confidentiality and integrity impact than Red Hat's assessment. All Red Hat Enterprise Linux 6, 7, 8, 9, and 10 kernel and kernel-rt update streams, as well as the Red Hat In-Vehicle OS kernel streams, are not affected because the vulnerable code is not present in the kernel versions shipped in those products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.