Linux Kernel EUVD-2026-27733

The io_uring subsystem in the Linux kernel provides asynchronous I/O operations, and its zero-copy receive (zcrx) extension allows network data to be mapped directly into user space page pools without copying. The affected CPE is cpe:2.3:a:linux:linux across versions reaching 6.15. The vulnerability arises in post-open error handling for zcrx queues: when a queue is closed, the associated page pools are not guaranteed to be immediately deallocated. The original code path released the zcrx context directly on error, bypassing the reference-counting teardown. The correct behavior - implemented by the fix - is to allow refcounting to drive resource cleanup, preventing a use-after-free or premature deallocation scenario. No CWE was formally assigned, but the root cause class is consistent with CWE-672 (Operation on a Resource After Expiration or Release) or CWE-362 (Race Condition). The information disclosure tag applied by Red Hat and SUSE appears inconsistent with the CVSS vector (C:N), and may reflect conservative tagging policy rather than a confirmed confidentiality impact.