A race condition in the Linux kernel’s io_uring zcrx subsystem allows concurrent execution of the scrub and refill paths. The bug causes a reference counter to underflow to –1 and results in a double‑free of an internal buffer. Subsequent freelist pushes write beyond the bounds of the allocated array, corrupting adjacent slab objects in kernel memory. Kernel memory corruption of this nature can enable arbitrary code execution at kernel privilege level, thereby providing the potential for privilege escalation.

All Linux kernel releases that contain the io_uring zcrx implementation and have not yet incorporated the commit fixing the race. No specific version numbers are listed, so any kernel prior to the fix is considered vulnerable.

The CVSS score of 4.7 indicates moderate severity. The EPSS score of < 1 % suggests a very low probability of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Because the flaw results in a kernel memory corruption that could be leveraged for code execution, the risk remains significant for systems that support io_uring and do not employ additional hardening such as KASLR, SELinux, or lockdown features.