CVE-2026-80713

CVE-2026-80713 is a flaw in the Linux kernel's io_uring subsystem: on execve, the exec cancellation path called __io_uring_free(), which freed both the task's io_uring context and any per-task restrictions installed on it, so rings created by the same task after exec ran without those restrictions. It is triggered when a process that has used io_uring and had per-task restrictions installed calls exec; the fix splits task-context cleanup into a new io_uring_free_tctx() used by the exec path, while __io_uring_free() keeps releasing context plus restrictions only at final task teardown. A low-privileged local attacker who can run code in a restricted task could regain unrestricted io_uring use after exec, bypassing an intended security boundary, which is reflected in the CVSS 3.1 'scope changed' rating with high confidentiality/integrity impact (8.4 High). Any Linux system running a kernel with the per-task io_uring restrictions feature is affected, though practical impact concentrates in environments (sandboxing or service-management setups) that actually rely on those restrictions; the source data provides no affected or fixed version ranges. No exploitation is currently known: EPSS is about 0.1% (1st percentile), the issue is not in CISA KEV, and no public proof-of-concept exists.

What to do: Deploy a kernel that includes the fix splitting exec-path cleanup into io_uring_free_tctx(); the source data lists no fixed version numbers, so track your distribution's stable/LTS kernel updates and vendor backports. Check whether your sandboxing or service-management tooling installs per-task io_uring restrictions and whether protected processes exec afterwards, and as an interim mitigation restrict io_uring system-wide where your kernel supports it (e.g., the kernel.io_uring_disabled sysctl) until patched.