Linux Kernel Epoll Data-Race Vulnerability Allowing Denial-of-Service

A data-race vulnerability has been identified in the Linux kernel's epoll implementation, specifically in versions prior to 5.17.0. This vulnerability arises because the function 'ep_events_available()' is called without a lock, allowing concurrent tasks to interfere with each other. The issue was reported by the Kernel Concurrency Sanitizer, indicating that one task can read from a list while another task is writing to it, potentially leading to inconsistent data being processed.

Impact

Exploitation of this vulnerability can cause a denial-of-service condition by disrupting the normal operation of the epoll event polling mechanism, which can lead to increased resource usage or application unresponsiveness.