Executive brief
A race condition was identified in the Linux kernel's io_uring subsystem, specifically within the zero-copy receive (zcrx) feature. This flaw could allow a local attacker to cause a system crash or instability by triggering a memory management error. The issue stems from how the system tracks internal references, which can lead to a 'double-free' scenario where the same memory is released twice.
Technical details
A race condition exists in io_uring/zcrx due to improper synchronization of the user_refs counter. The function io_zcrx_put_niov_uref() uses a non-atomic check-then-decrement pattern (atomic_read followed by atomic_dec) serialized by rq_lock. However, io_zcrx_scrub() modifies the same counter using atomic_xchg() without holding the lock. On SMP systems, this allows a race where a net_iov (niov) can be pushed to the freelist twice. This double-free causes the free_count to exceed nr_iovs, leading to an out-of-bounds u32 write into adjacent slab objects during subsequent freelist operations. The fix implements an atomic_try_cmpxchg loop to ensure the test-and-decrement operation is atomic.
Affected products
- Linux Linux Kernel 6.15 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2026-02-18: patched: Initial patch authored and committed to mainline kernel.
- 2026-05-06: disclosed: CVE-2026-43121 published.