Linux Kernel EUVD-2026-12900

While CVSS and EPSS scores are not available for this CVE, the risk assessment must rely on available signals: the vulnerability is a local denial-of-service condition requiring kernel execution privileges or triggering via unprivileged io_uring operations. The attack complexity is relatively low—an attacker need only trigger a specific error condition in scatter-gather initialization. The vulnerability affects the widely-deployed Linux kernel, increasing potential impact across all Linux systems. However, exploitation requires local system access or capability to issue io_uring syscalls; remote attackers cannot directly exploit this. The fact that a patch exists and is already in stable kernel branches (as evidenced by the git.kernel.org references) significantly reduces real-world risk. This is a medium-priority issue: it affects a commonly-used subsystem and can cause denial of service, but requires local access and is already patched in current kernel releases.

A local attacker with access to io_uring operations (available to unprivileged users in most kernel configurations) repeatedly triggers scatter-gather initialization failures in the zcrx receive path, causing the kernel to leak page array allocations with each failed operation. Over time, kernel memory exhaustion leads to denial of service as the system becomes unable to allocate memory for legitimate operations, potentially crashing or becoming unresponsive. The attack requires no special privileges or complex exploitation techniques—simply issuing malformed io_uring zcrx operations with failing scatter-gather setup will trigger the leak.