Re: CVE request: io_uring zcrx freelist OOB write

[Pavel Begunkov <asml.silence () gmail com>]

On 5/3/26 12:00, Mohamed salem Eddah wrote:
> Hello,
>
> I am reporting a security issue in the Linux kernel involving an
> out-of-bounds heap write in io_uring/zcrx.c.
>
> This issue appears to have been addressed in commit 770594e
> (“io_uring/zcrx: warn on freelist violations”, April 21, 2026), however it
> was not assigned a CVE and does not appear to have been included in a
> formal security advisory. As a result, multiple stable and downstream
> distribution kernels are still affected.
> ------------------------------
> Vulnerability Summary
>
> *File:* io_uring/zcrx.c
> *Function:* io_zcrx_return_niov_freelist()
> *Introduced:* Linux 6.12 (initial ZCRX merge)

FWIW, it was added IIRC in 6.15, but not 6.12

> *Fixed upstream:* 770594e (Apr 21, 2026)
> *Status:* Fix not yet present in stable releases
Did you trigger the problem or the warning in a new kernel
without the attached modules? Which kernel version / hash
was it? There was a fix for the scrub case, but otherwise
don't immediately see how that can happen. I'll take a look.

--
Pavel Begunkov