CVE-2026-43121

io_uring/zcrx: fix user_ref race between scrub and refill paths

Published May 6, 2026 CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

io_uring/zcrx: fix user_ref race between scrub and refill paths

The io_zcrx_put_niov_uref() function uses a non-atomic
check-then-decrement pattern (atomic_read followed by separate
atomic_dec) to manipulate user_refs. This is serialized against other
callers by rq_lock, but io_zcrx_scrub() modifies the same counter with
atomic_xchg() WITHOUT holding rq_lock.

On SMP systems, the following race exists:

CPU0 (refill, holds rq_lock) CPU1 (scrub, no rq_lock)
put_niov_uref:
atomic_read(uref) - 1
// window opens
atomic_xchg(uref, 0) - 1
return_niov_freelist(niov) [PUSH #1]
// window closes
atomic_dec(uref) - wraps to -1
returns true
return_niov(niov)
return_niov_freelist(niov) [PUSH #2: DOUBLE-FREE]

The same niov is pushed to the freelist twice, causing free_count to
exceed nr_iovs. Subsequent freelist pushes then perform an out-of-bounds
write (a u32 value) past the kvmalloc'd freelist array into the adjacent
slab object.

Fix this by replacing the non-atomic read-then-dec in
io_zcrx_put_niov_uref() with an atomic_try_cmpxchg loop that atomically
tests and decrements user_refs. This makes the operation safe against
concurrent atomic_xchg from scrub without requiring scrub to acquire
rq_lock.

[pavel: removed a warning and a comment]

Analysis

Technical impact

A race condition in the Linux kernel’s io_uring zcrx subsystem allows concurrent execution of the scrub and refill paths. The bug causes a reference counter to underflow to –1 and results in a double‑free of an internal buffer. Subsequent freelist pushes write beyond the bounds of the allocated array, corrupting adjacent slab objects in kernel memory. Kernel memory corruption of this nature can enable arbitrary code execution at kernel privilege level, thereby providing the potential for privilege escalation.

Affected Systems

All Linux kernel releases that contain the io_uring zcrx implementation and have not yet incorporated the commit fixing the race. No specific version numbers are listed, so any kernel prior to the fix is considered vulnerable.

Risk and Exploitability

The CVSS score of 4.7 indicates moderate severity. The EPSS score of < 1 % suggests a very low probability of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Because the flaw results in a kernel memory corruption that could be leveraged for code execution, the risk remains significant for systems that support io_uring and do not employ additional hardening such as KASLR, SELinux, or lockdown features.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`34a3e60821ab9f335a58d43a88cccdbefdebdec3`	affected	< a94f096e28bfc7975163a6b80f1c8f323efe317a
`34a3e60821ab9f335a58d43a88cccdbefdebdec3`	affected	< 485dc691257b96e6d3bdc25b0eff2daadcc5c46c
`34a3e60821ab9f335a58d43a88cccdbefdebdec3`	affected	< 003049b1c4fb8aabb93febb7d1e49004f6ad653b

Linux

affected

Version	Status	Constraints
`6.15`	affected	—
`0`	unaffected	< 6.15
`6.18.16`	unaffected	≤ 6.18.*
`6.19.6`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[34a3e60821ab9f335a58d43a88cccdbefdebdec3,a94f096e28bfc7975163a6b80f1c8f323efe317a)`	affected	code_commit	—
`[34a3e60821ab9f335a58d43a88cccdbefdebdec3,485dc691257b96e6d3bdc25b0eff2daadcc5c46c)`	affected	code_commit	—
`[34a3e60821ab9f335a58d43a88cccdbefdebdec3,003049b1c4fb8aabb93febb7d1e49004f6ad653b)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.15`	affected	generic	—
`[0,6.15)`	unaffected	generic	—
`[6.18.16,6.19.0)`	unaffected	semver	—
`[6.19.6,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest kernel update that incorporates the commit patches the io_uring zcrx race condition
If a kernel update cannot be applied immediately, disable or restrict use of io_uring to prevent the vulnerable code paths from being exercised
If the kernel remains unpatched, monitor system logs for unusual memory corruption events to detect exploitation attempts

Generated by OpenCVE AI on May 13, 2026 at 01:05 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.111% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/003049b1c4fb8aabb93febb7d1e49004f6ad653b
https://git.kernel.org/stable/c/485dc691257b96e6d3bdc25b0eff2daadcc5c46c
https://git.kernel.org/stable/c/a94f096e28bfc7975163a6b80f1c8f323efe317a
https://lore.kernel.org/linux-cve-announce/2026050618-CVE-2026-43121-2a26@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-43121
https://www.cve.org/CVERecord?id=CVE-2026-43121

History

May 12, 2026 9:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-362
Metrics		cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

May 7, 2026 4:30 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-125 CWE-362 CWE-415

May 7, 2026 12:15 AM Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Weaknesses		CWE-366
References		https://lore.kernel.org/linux-cve-announce/2026050618-CVE-2026-43121-2a26@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-43121 https://www.cve.org/CVERecord?id=CVE-2026-43121

May 6, 2026 2:45 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-125 CWE-362 CWE-415

May 6, 2026 12:15 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix user_ref race between scrub and refill paths The io_zcrx_put_niov_uref() function uses a non-atomic check-then-decrement pattern (atomic_read followed by separate atomic_dec) to manipulate user_refs. This is serialized against other callers by rq_lock, but io_zcrx_scrub() modifies the same counter with atomic_xchg() WITHOUT holding rq_lock. On SMP systems, the following race exists: CPU0 (refill, holds rq_lock) CPU1 (scrub, no rq_lock) put_niov_uref: atomic_read(uref) - 1 // window opens atomic_xchg(uref, 0) - 1 return_niov_freelist(niov) [PUSH #1] // window closes atomic_dec(uref) - wraps to -1 returns true return_niov(niov) return_niov_freelist(niov) [PUSH #2: DOUBLE-FREE] The same niov is pushed to the freelist twice, causing free_count to exceed nr_iovs. Subsequent freelist pushes then perform an out-of-bounds write (a u32 value) past the kvmalloc'd freelist array into the adjacent slab object. Fix this by replacing the non-atomic read-then-dec in io_zcrx_put_niov_uref() with an atomic_try_cmpxchg loop that atomically tests and decrements user_refs. This makes the operation safe against concurrent atomic_xchg from scrub without requiring scrub to acquire rq_lock. [pavel: removed a warning and a comment]
Title		io_uring/zcrx: fix user_ref race between scrub and refill paths
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/003049b1c4fb8aabb93febb7d1e49004f6ad653b https://git.kernel.org/stable/c/485dc691257b96e6d3bdc25b0eff2daadcc5c46c https://git.kernel.org/stable/c/a94f096e28bfc7975163a6b80f1c8f323efe317a