[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <2026050325-dance-campsite-01ae@gregkh>
Date: Sun, 3 May 2026 13:32:21 +0200
From: Greg KH <gregkh@...uxfoundation.org>
To: Mohamed salem Eddah <medsalemeddah@...il.com>
Cc: security@...nel.org, oss-security@...ts.openwall.com,
"asml.Silence@...il.com" <asml.Silence@...il.com>,
"axboe@...nel.dk" <axboe@...nel.dk>
Subject: Re: CVE request: io_uring zcrx freelist OOB write
On Sun, May 03, 2026 at 07:00:06AM -0400, Mohamed salem Eddah wrote:
> This issue appears to have been addressed in commit 770594e
> (“io_uring/zcrx: warn on freelist violations”, April 21, 2026), however it
> was not assigned a CVE and does not appear to have been included in a
> formal security advisory. As a result, multiple stable and downstream
> distribution kernels are still affected.
> ------------------------------
> Vulnerability Summary
>
> *File:* io_uring/zcrx.c
> *Function:* io_zcrx_return_niov_freelist()
> *Introduced:* Linux 6.12 (initial ZCRX merge)
> *Fixed upstream:* 770594e (Apr 21, 2026)
> *Status:* Fix not yet present in stable releases
<formletter>
Please see:
https://www.kernel.org/doc/html/latest/process/cve.html
for how kernel CVEs are assigned.
</formletter>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
