Skip to main content

Linux Kernel CVE-2026-43224

| EUVDEUVD-2026-27785 MEDIUM
Memory Leak (CWE-401)
2026-05-06 Linux GHSA-xrvp-77wr-x978
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access and low privileges required; architecture-specific DMA failure path causes memory leak only, with no confidentiality or integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
Analysis Generated
Jul 24, 2026 - 00:59 vuln.today
CVSS changed
May 08, 2026 - 21:22 NVD
5.5 (MEDIUM)
CVE Published
May 06, 2026 - 11:28 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

io_uring/zcrx: fix sgtable leak on mapping failures

In an unlikely case when io_populate_area_dma() fails, which could only happen on a PAGE_POOL_32BIT_ARCH_WITH_64BIT_DMA machine, io_zcrx_map_area() will have an initialised and not freed table. It was supposed to be cleaned up in the error path, but !is_mapped prevents that.

AnalysisAI

Memory leak in the Linux kernel io_uring zero-copy receive (zcrx) subsystem allows a local low-privileged attacker to exhaust kernel memory via repeated DMA mapping failures on PAGE_POOL_32BIT_ARCH_WITH_64BIT_DMA systems, causing denial of service. The root cause is a sgtable (scatter-gather table) resource that is initialized but never freed when io_populate_area_dma() fails, because the error path's cleanup guard (!is_mapped) incorrectly skips deallocation. No public exploit exists and EPSS is 0.02% (4th percentile), reflecting the narrow hardware-specific trigger condition.

Technical ContextAI

The vulnerability resides in io_uring's zero-copy receive (zcrx) path, a high-performance feature introduced to allow direct network packet delivery into userspace-mapped memory without kernel-to-userspace data copies. The affected function io_zcrx_map_area() allocates a struct sg_table (scatter-gather table) during DMA setup and calls io_populate_area_dma() to populate it. On systems compiled with PAGE_POOL_32BIT_ARCH_WITH_64BIT_DMA - a build configuration for 32-bit architectures with 64-bit DMA address space - this DMA population step can fail. The error path in io_zcrx_map_area() is gated by !is_mapped, but since the mapping failed before is_mapped was set, the guard evaluates true and skips sgtable cleanup, producing a classic CWE-401 (Missing Release of Memory after Effective Lifetime) leak. CPE identifies the affected product as cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* across multiple stable branches originating from commit 439a98b972fbb1991819b5367f482cd4161ba39c.

RemediationAI

Upgrade to Linux kernel 6.18.16, 6.19.6, or 7.0, which contain the corrected error-path cleanup logic in io_zcrx_map_area() ensuring the sgtable is freed on DMA mapping failure. The upstream stable patches are indexed at https://git.kernel.org/stable/c/a983aae397767e9da931128ff2b5bf9066513ce3 (6.19.x branch), https://git.kernel.org/stable/c/ef075c1464ac9047e2cf7d23cb020bfd0b8e4b60 (6.18.x branch), and https://git.kernel.org/stable/c/f1ae403324311e143ef20e53cf9a5f01e312f7c9 (another stable branch). For systems where an immediate kernel upgrade is not feasible, a targeted workaround is to disable io_uring at the kernel level using the sysctl knob 'kernel.io_uring_disabled=1' (available since Linux 5.15), which prevents the vulnerable zcrx code path from being reached entirely; the trade-off is loss of io_uring-based I/O performance for any applications depending on it. Alternatively, restricting io_uring access to privileged users only ('kernel.io_uring_group=<gid>') reduces the exploitation surface without fully disabling the feature. Systems not built with PAGE_POOL_32BIT_ARCH_WITH_64BIT_DMA require no action.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43224 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy