The Linux kernel’s io_uring zcrx implementation contains a flaw that occurs when a queue is closed without guaranteeing that all related page pools are terminated immediately. The commit that fixed the issue, referenced in the advisory, indicates that the current logic releases the zcrx context directly instead of letting reference counting conclude, leaving dangling references. Based on the description, it is inferred that this omission can lead to use‑after‑free or other memory corruption, potentially causing a kernel panic or denial of service if an attacker can trigger the erroneous cleanup.

All Linux distributions that run a kernel build before the inclusion of the fix in commit 18afaff077b46655a8eb6fd7f6de1b81327be577. No specific distribution or kernel release is enumerated in the advisory, so any older kernel that contains the before‑fix code is considered vulnerable.

The CVSS score is 5.5 and the EPSS score is less than 1 %, indicating moderate severity and a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, so there are no known active attacks. Nevertheless, if an attacker can trigger the erroneous cleanup in io_uring zcrx, it could lead to a kernel panic or denial of service via a use‑after‑free or related memory corruption.