[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <2b8f2e56-15be-4732-baf5-7a3df4f8a1fe@gmail.com>
Date: Mon, 4 May 2026 07:02:30 +0100
From: Pavel Begunkov <asml.silence@...il.com>
To: Mohamed salem Eddah <medsalemeddah@...il.com>, security@...nel.org,
oss-security@...ts.openwall.com, "axboe@...nel.dk" <axboe@...nel.dk>
Subject: Re: CVE request: io_uring zcrx freelist OOB write
On 5/3/26 12:00, Mohamed salem Eddah wrote:
> Hello,
>
> I am reporting a security issue in the Linux kernel involving an
> out-of-bounds heap write in io_uring/zcrx.c.
>
> This issue appears to have been addressed in commit 770594e
> (“io_uring/zcrx: warn on freelist violations”, April 21, 2026), however it
> was not assigned a CVE and does not appear to have been included in a
> formal security advisory. As a result, multiple stable and downstream
> distribution kernels are still affected.
> ------------------------------
> Vulnerability Summary
>
> *File:* io_uring/zcrx.c
> *Function:* io_zcrx_return_niov_freelist()
> *Introduced:* Linux 6.12 (initial ZCRX merge)
FWIW, it was added IIRC in 6.15, but not 6.12
> *Fixed upstream:* 770594e (Apr 21, 2026)
> *Status:* Fix not yet present in stable releases
Did you trigger the problem or the warning in a new kernel
without the attached modules? Which kernel version / hash
was it? There was a fix for the scrub case, but otherwise
don't immediately see how that can happen. I'll take a look.
--
Pavel Begunkov
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
