CVE-2026-43121 (GCVE-0-2026-43121)
Vulnerability from cvelistv5 – Published: 2026-05-06 11:27 – Updated: 2026-05-06 11:27
VLAI?
Title
io_uring/zcrx: fix user_ref race between scrub and refill paths
Summary
In the Linux kernel, the following vulnerability has been resolved:
io_uring/zcrx: fix user_ref race between scrub and refill paths
The io_zcrx_put_niov_uref() function uses a non-atomic
check-then-decrement pattern (atomic_read followed by separate
atomic_dec) to manipulate user_refs. This is serialized against other
callers by rq_lock, but io_zcrx_scrub() modifies the same counter with
atomic_xchg() WITHOUT holding rq_lock.
On SMP systems, the following race exists:
CPU0 (refill, holds rq_lock) CPU1 (scrub, no rq_lock)
put_niov_uref:
atomic_read(uref) - 1
// window opens
atomic_xchg(uref, 0) - 1
return_niov_freelist(niov) [PUSH #1]
// window closes
atomic_dec(uref) - wraps to -1
returns true
return_niov(niov)
return_niov_freelist(niov) [PUSH #2: DOUBLE-FREE]
The same niov is pushed to the freelist twice, causing free_count to
exceed nr_iovs. Subsequent freelist pushes then perform an out-of-bounds
write (a u32 value) past the kvmalloc'd freelist array into the adjacent
slab object.
Fix this by replacing the non-atomic read-then-dec in
io_zcrx_put_niov_uref() with an atomic_try_cmpxchg loop that atomically
tests and decrements user_refs. This makes the operation safe against
concurrent atomic_xchg from scrub without requiring scrub to acquire
rq_lock.
[pavel: removed a warning and a comment]
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
34a3e60821ab9f335a58d43a88cccdbefdebdec3 , < a94f096e28bfc7975163a6b80f1c8f323efe317a
(git)
Affected: 34a3e60821ab9f335a58d43a88cccdbefdebdec3 , < 485dc691257b96e6d3bdc25b0eff2daadcc5c46c (git) Affected: 34a3e60821ab9f335a58d43a88cccdbefdebdec3 , < 003049b1c4fb8aabb93febb7d1e49004f6ad653b (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"io_uring/zcrx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a94f096e28bfc7975163a6b80f1c8f323efe317a",
"status": "affected",
"version": "34a3e60821ab9f335a58d43a88cccdbefdebdec3",
"versionType": "git"
},
{
"lessThan": "485dc691257b96e6d3bdc25b0eff2daadcc5c46c",
"status": "affected",
"version": "34a3e60821ab9f335a58d43a88cccdbefdebdec3",
"versionType": "git"
},
{
"lessThan": "003049b1c4fb8aabb93febb7d1e49004f6ad653b",
"status": "affected",
"version": "34a3e60821ab9f335a58d43a88cccdbefdebdec3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"io_uring/zcrx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/zcrx: fix user_ref race between scrub and refill paths\n\nThe io_zcrx_put_niov_uref() function uses a non-atomic\ncheck-then-decrement pattern (atomic_read followed by separate\natomic_dec) to manipulate user_refs. This is serialized against other\ncallers by rq_lock, but io_zcrx_scrub() modifies the same counter with\natomic_xchg() WITHOUT holding rq_lock.\n\nOn SMP systems, the following race exists:\n\n CPU0 (refill, holds rq_lock) CPU1 (scrub, no rq_lock)\n put_niov_uref:\n atomic_read(uref) - 1\n // window opens\n atomic_xchg(uref, 0) - 1\n return_niov_freelist(niov) [PUSH #1]\n // window closes\n atomic_dec(uref) - wraps to -1\n returns true\n return_niov(niov)\n return_niov_freelist(niov) [PUSH #2: DOUBLE-FREE]\n\nThe same niov is pushed to the freelist twice, causing free_count to\nexceed nr_iovs. Subsequent freelist pushes then perform an out-of-bounds\nwrite (a u32 value) past the kvmalloc\u0027d freelist array into the adjacent\nslab object.\n\nFix this by replacing the non-atomic read-then-dec in\nio_zcrx_put_niov_uref() with an atomic_try_cmpxchg loop that atomically\ntests and decrements user_refs. This makes the operation safe against\nconcurrent atomic_xchg from scrub without requiring scrub to acquire\nrq_lock.\n\n[pavel: removed a warning and a comment]"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-06T11:27:08.216Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a94f096e28bfc7975163a6b80f1c8f323efe317a"
},
{
"url": "https://git.kernel.org/stable/c/485dc691257b96e6d3bdc25b0eff2daadcc5c46c"
},
{
"url": "https://git.kernel.org/stable/c/003049b1c4fb8aabb93febb7d1e49004f6ad653b"
}
],
"title": "io_uring/zcrx: fix user_ref race between scrub and refill paths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43121",
"datePublished": "2026-05-06T11:27:08.216Z",
"dateReserved": "2026-05-01T14:12:55.987Z",
"dateUpdated": "2026-05-06T11:27:08.216Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-43121",
"date": "2026-05-08",
"epss": "0.00017",
"percentile": "0.04094"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-43121\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-06T12:16:28.950\",\"lastModified\":\"2026-05-06T13:07:51.607\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nio_uring/zcrx: fix user_ref race between scrub and refill paths\\n\\nThe io_zcrx_put_niov_uref() function uses a non-atomic\\ncheck-then-decrement pattern (atomic_read followed by separate\\natomic_dec) to manipulate user_refs. This is serialized against other\\ncallers by rq_lock, but io_zcrx_scrub() modifies the same counter with\\natomic_xchg() WITHOUT holding rq_lock.\\n\\nOn SMP systems, the following race exists:\\n\\n CPU0 (refill, holds rq_lock) CPU1 (scrub, no rq_lock)\\n put_niov_uref:\\n atomic_read(uref) - 1\\n // window opens\\n atomic_xchg(uref, 0) - 1\\n return_niov_freelist(niov) [PUSH #1]\\n // window closes\\n atomic_dec(uref) - wraps to -1\\n returns true\\n return_niov(niov)\\n return_niov_freelist(niov) [PUSH #2: DOUBLE-FREE]\\n\\nThe same niov is pushed to the freelist twice, causing free_count to\\nexceed nr_iovs. Subsequent freelist pushes then perform an out-of-bounds\\nwrite (a u32 value) past the kvmalloc\u0027d freelist array into the adjacent\\nslab object.\\n\\nFix this by replacing the non-atomic read-then-dec in\\nio_zcrx_put_niov_uref() with an atomic_try_cmpxchg loop that atomically\\ntests and decrements user_refs. This makes the operation safe against\\nconcurrent atomic_xchg from scrub without requiring scrub to acquire\\nrq_lock.\\n\\n[pavel: removed a warning and a comment]\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/003049b1c4fb8aabb93febb7d1e49004f6ad653b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/485dc691257b96e6d3bdc25b0eff2daadcc5c46c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a94f096e28bfc7975163a6b80f1c8f323efe317a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…