The Linux kernel’s io_uring/zcrx subsystem had a memory leak that occurred when an sg initialization failed. A page array was allocated but not freed, resulting in uncontrolled kernel memory consumption. This flaw can lead to memory exhaustion and potential system instability, matching the weakness identified as CWE-400: Uncontrolled Resource Consumption.

All Linux kernels that implement the io_uring/zcrx API before the commit referenced in the advisory are affected. No specific kernel version numbers are provided, so any installation that has not applied the commit that fixed the leak remains vulnerable.

No CVSS or EPSS score is supplied, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires local access with the ability to invoke io_uring system calls. The lack of severity scores and exploit information suggests a moderate to high risk for systems heavily using io_uring, but this assessment is an inference and not directly stated in the data.