CVE-2022-49791: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability (CVE-2022-49791) was identified in the Linux kernel related to iouring multishot accept request leaks. The issue was discovered and disclosed in May 2025, affecting the iouring subsystem. The vulnerability occurs when REQFPOLLED is set, which doesn't guarantee that the request is executed as a multishot from the polling path (NVD, Wiz).

The vulnerability stems from a condition where having REQFPOLLED set doesn't ensure multishot execution from the polling path. When the code incorrectly assumes it's a multishot issue when it's not, it can only ask to skip completion, resulting in request leakage. The fix involves using issue_flags to properly mark multipoll issues (NVD, Red Hat).

The vulnerability can lead to request leakage in the Linux kernel's io_uring subsystem, potentially affecting system resource management and stability (Red Hat).

Red Hat Enterprise Linux 9 has deferred the fix for this vulnerability in both the kernel and kernel-rt packages. Other versions of Red Hat Enterprise Linux (6, 7, and 8) are not affected by this vulnerability (Red Hat).