The vulnerability involves the io_uring operation IORING_OP_WAITID, which stores result fields in a kernel structure io_waitid::info and later copies them to userspace siginfo. The preparation path initializes request arguments but does not clear the info structure itself. If the wait operation completes without a child event, the common wait code may return without writing to info, causing io_waitid_finish() to copy uninitialized stale bytes from reused command storage to userspace. The fix clears the result storage during preparation to match the behavior of the regular waitid syscall that uses zero-initialized structures, preventing leakage of stale kernel memory.

This vulnerability can lead to information disclosure by exposing stale kernel memory bytes to userspace processes via the io_uring waitid operation. The impact is limited to local attackers with the ability to invoke this syscall, as indicated by the CVSS vector (Attack Vector: Local, Privileges Required: Low). There is no indication of privilege escalation or remote exploitation. No known exploits are reported in the wild.

A fix is available in Linux kernel versions 7.0.0-28.28.1 and later. Users should update their Linux kernel to a version including this patch to prevent exposure of stale kernel memory via io_uring waitid operations. Since this is a kernel-level vulnerability, applying the official kernel update from the vendor is the recommended remediation. No additional mitigations are specified.