Skip to main content

Linux Kernel EUVDEUVD-2026-27682

| CVE-2026-43121 MEDIUM
Race Condition (CWE-362)
2026-05-06 Linux GHSA-77p3-mmmp-fjj2
Buffer Overflow Linux Race Condition
4.7
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

Local SMP race requiring low-privilege access and precise timing (AC:H); only availability impacted via kernel panic from heap corruption; no confidentiality or integrity impact confirmed.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 01:12 vuln.today
CVSS changed
May 12, 2026 - 21:22 NVD
4.7 (MEDIUM)
Patch available
May 06, 2026 - 13:02 EUVD
CVE Published
May 06, 2026 - 11:27 nvd
MEDIUM 4.7

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

io_uring/zcrx: fix user_ref race between scrub and refill paths

The io_zcrx_put_niov_uref() function uses a non-atomic check-then-decrement pattern (atomic_read followed by separate atomic_dec) to manipulate user_refs. This is serialized against other callers by rq_lock, but io_zcrx_scrub() modifies the same counter with atomic_xchg() WITHOUT holding rq_lock.

On SMP systems, the following race exists:

CPU0 (refill, holds rq_lock) CPU1 (scrub, no rq_lock) put_niov_uref: atomic_read(uref) - 1 // window opens atomic_xchg(uref, 0) - 1 return_niov_freelist(niov) [PUSH #1] // window closes atomic_dec(uref) - wraps to -1 returns true return_niov(niov) return_niov_freelist(niov) [PUSH #2: DOUBLE-FREE]

The same niov is pushed to the freelist twice, causing free_count to exceed nr_iovs. Subsequent freelist pushes then perform an out-of-bounds write (a u32 value) past the kvmalloc'd freelist array into the adjacent slab object.

Fix this by replacing the non-atomic read-then-dec in io_zcrx_put_niov_uref() with an atomic_try_cmpxchg loop that atomically tests and decrements user_refs. This makes the operation safe against concurrent atomic_xchg from scrub without requiring scrub to acquire rq_lock.

[pavel: removed a warning and a comment]

AnalysisAI

Race condition in the Linux kernel io_uring zero-copy receive (zcrx) subsystem allows a local low-privileged attacker on SMP systems running kernel 6.15 through 6.18.15 or 6.19.0-6.19.5 to trigger a double-free of a network I/O vector (niov) and subsequently corrupt adjacent kernel heap memory with an out-of-bounds write. The root cause is a non-atomic check-then-decrement in io_zcrx_put_niov_uref() racing against atomic_xchg() in io_zcrx_scrub(), which bypasses the rq_lock serialization. No public exploit has been identified at time of analysis; EPSS at 0.02% (4th percentile) confirms negligible current exploitation probability.

Technical ContextAI

The vulnerability resides in the io_uring subsystem's zero-copy receive (zcrx) path, introduced in Linux 6.15. The function io_zcrx_put_niov_uref() performs a TOCTOU (CWE-362) sequence: atomic_read() followed by a separate atomic_dec() on the user_refs counter, which are individually atomic but not atomic as a combined test-and-decrement. The refill path serializes this pair via rq_lock, but io_zcrx_scrub() issues an atomic_xchg(uref, 0) without acquiring rq_lock. On SMP systems, the window between atomic_read and atomic_dec allows scrub to zero user_refs and return the niov to the freelist concurrently; the refill path then observes a stale read, decrements to -1 (wrap), and also returns the same niov - yielding a double-push to the freelist. This causes free_count to exceed nr_iovs, and subsequent freelist pushes write a u32 value out-of-bounds past the kvmalloc'd freelist array into an adjacent slab object. The fix replaces the non-atomic pair with an atomic_try_cmpxchg loop. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to patched kernel versions: Linux 6.18.16, Linux 6.19.6, or Linux 7.0 (mainline). The upstream fix is delivered via three stable commits available at https://git.kernel.org/stable/c/a94f096e28bfc7975163a6b80f1c8f323efe317a (6.18 branch), https://git.kernel.org/stable/c/485dc691257b96e6d3bdc25b0eff2daadcc5c46c (6.19 branch), and https://git.kernel.org/stable/c/003049b1c4fb8aabb93febb7d1e49004f6ad653b (mainline). Red Hat and SUSE users should monitor vendor security advisories for distribution-specific package updates. As a compensating control where immediate patching is not feasible, disabling io_uring system-wide via 'sysctl -w kernel.io_uring_disabled=1' (full disable) or '=2' (restrict to privileged users only) will prevent exploitation, but will break applications relying on io_uring for high-performance I/O - evaluate application impact before applying. Alternatively, since zcrx requires active application use, environments not running workloads that set up zcrx rings are not practically exposed even on unpatched kernels.

Same weakness CWE-362 – Race Condition

View all
CVE-2023-36884 HIGH POC
7.5
CVE-2016-5195 HIGH POC
7.0
CVE-2017-1000112 HIGH POC
7.0
CVE-2014-0196 MEDIUM POC
5.5
CVE-2014-0226 MEDIUM POC
6.8
CVE-2016-1757 HIGH POC
7.0
CVE-2016-8655 HIGH POC
7.8
CVE-2015-5754 CRITICAL POC
9.3

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-27682 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy