It's complex. No, there's nothing so fundamental about io-uring that it could not be made safe. But also, there are significant factors that are leading to it b

It's complex. No, there's nothing so fundamental about io-uring that it could not be made safe. But also, there are significant factors that are leading to it being ripe for exploitation. 1. Security has been sort of an afterthought. io_uring was being built out as a complex, powerful capability and only much later were things like auditing, selinux hooks, and ebpf even considered. 2. io_uring is inherently complex code. It's highly optimized, concurrent, and new. It does a lot of work to avoid things like copying across the kernel boundary. This code is hard to get right under the best of circumstances. 3. io_uring is very different. This is basically a new system call interface that behaves in a different way from the other interface, we're playing catch up in security. So in theory this could all be fixed but it's going to take a lot of work and, importantly, a shift in priorities - io_uring can't just be developed as the "gotta go fast" interface, it needs to be designed around safety.