Based on the description, a race condition in the Linux kernel’s io_uring zcrx subsystem allows concurrent execution of the scrub and refill paths to double‑free a buffer structure. The double free causes the buffer’s reference counter to wrap to –1, and subsequent freelist pushes write a 32‑bit value past the allocated array into adjacent kernel memory. This out‑of‑bounds write corrupts kernel data structures and, based on the typical impact of kernel memory corruption, it is inferred that an attacker could gain elevated privileges by executing arbitrary code in supervisor mode.

All Linux kernels that include the io_uring zcrx implementation and have not yet incorporated the patch referenced in the provided commit URLs. No specific version numbers are listed, so any kernel prior to the fix is considered vulnerable.

Although the CVSS score is not published, the kernel memory corruption described is a high‑severity fault. No publicly confirmed exploits are listed. The feature is only exposed through the io_uring interface, so limited to workloads that use io_uring. Based on the description, it is inferred that the out‑of‑bounds write could lead to arbitrary kernel code execution, making the risk substantial for affected systems. The vulnerability is not listed in CISA’s KEV catalog, indicating no known large‑scale exploitation yet.