[Asmod4n]

The main reason why it gets disabled is fixed now, the latest RC got cBPF support and as such you can restrict what OPs can be run now instead of just fully disabling it.

[mort96]

Well the reason it's disabled now is the recent history of pretty bad vulnerabilities. It probably needs to go a while without new vulnerabilities before it makes sense to enable by default. It's pretty complex completely unsafe C code, after all.

[Asmod4n]

Then just disable that singular function which causes the issue instead of a whole kernel subsystem. The current release can do that.

[mort96]

What's the singular function that has a chance of turning out to be exploitable in the future?

[Asmod4n]

With seccomp you can disable a single syscall which might be exploitable since you didn’t get around to patch your kernel, with cBPF you can now do the same for io_uring

[mort96]

And which single syscall might be exploitable? I don't wanna wait until after an exploit to disable it

[Asmod4n]

Nothing stops you from disabling everything you don’t need and now io_uring offers that per OP too.

[tempaccount420]

It's not complex actually, but it is C...