For anyone who wants an easily digestible read on io_uring exploits I love my former colleague's post: https://chompie.rip/Blog+Posts/Put+an+io_uring+on+it+-+Explo...
It was submitted under graplsecurity.com, chompie has since mirrored the research as the company no longer exists.