The Linux kernel’s io_uring/zcrx subsystem had a memory leak that occurred when an sg initialization failed. A page array was allocated but not freed, resulting in uncontrolled kernel memory consumption. This flaw can lead to memory exhaustion and potential system instability, matching the weakness identified as CWE-401: Memory Leak.

All Linux kernels that implement the io_uring/zcrx API before the commit referenced in the advisory are affected. No specific kernel version numbers are provided, so any installation that has not applied the commit that fixed the leak remains vulnerable.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of < 1% indicates a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, exploitation requires local access with the ability to invoke io_uring system calls. Given these metrics and the confirmed vulnerability, the risk for systems heavily using io_uring can be considered moderate to high, though the low EPSS suggests exploitation is not currently prevalent.