CVE-2026-43121

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

io_uring/zcrx: fix user_ref race between scrub and refill paths

The io_zcrx_put_niov_uref() function uses a non-atomic

check-then-decrement pattern (atomic_read followed by separate

atomic_dec) to manipulate user_refs. This is serialized against other

callers by rq_lock, but io_zcrx_scrub() modifies the same counter with

atomic_xchg() WITHOUT holding rq_lock.

On SMP systems, the following race exists:

CPU0 (refill, holds rq_lock) CPU1 (scrub, no rq_lock)

put_niov_uref:

atomic_read(uref) - 1

// window opens

atomic_xchg(uref, 0) - 1

return_niov_freelist(niov) [PUSH #1]

// window closes

atomic_dec(uref) - wraps to -1

returns true

return_niov(niov)

return_niov_freelist(niov) [PUSH #2: DOUBLE-FREE]

The same niov is pushed to the freelist twice, causing free_count to

exceed nr_iovs. Subseque

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References