CVE-2023-52654: io_uring/af_unix: disable sending io_uring over sockets

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-14 · updated 2026-08-04

Description

In the Linux kernel, the following vulnerability has been resolved: io_uring/af_unix: disable sending io_uring over sockets File reference cycles have caused lots of problems for io_uring in the past, and it still doesn't work exactly right and races with unix_stream_read_generic(). The safest fix would be to completely disallow sending io_uring files via sockets via SCM_RIGHT, so there are no possible cycles invloving registered files and thus rendering SCM accounting on the io_uring side unnecessary.

Affected products

Linux kernel: from 5.4.220 before 5.4.264; from 5.10.150 before 5.10.204; from 5.15.75 before 5.15.143; from 5.19.17 before 5.20; from 6.0.3 before 6.1.68; from 6.2 before 6.6.7 — fixed in 5.10.204, 5.15.143, 5.20, 5.4.264, 6.1.68, 6.6.7

How to fix

Upgrade to a fixed version: Linux kernel 5.10.204, 5.15.143, 5.20, 5.4.264. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-52654 or the next vulnerability affects your stack