Damned OOB — Linux Kernel io_uring ZCRX Freelist LPE (CVE-2026-43121)
Overview Attribute Value CVE ID CVE-2026-43121 Related CVE-2026-23263 (page array leak, same subsystem) CVSS Score ~7.8 (est., NVD enrichment pending) Vendor Linux Kernel Component io_uring/ZCRX (zero-copy receive) Vulnerability Type Missing bounds check → OOB heap write; Race condition → double-free Affected Linux kernel 6.12–6.19 (CONFIG_IO_URING_ZCRX=y) Patched ✅ Commit 770594e (bounds check) + 003049b1c4fb (atomic race fix), backported to v6.18.16 Exploit Status ⚠️ PoC demonstrated (kernel module + userspace harness) KEV Added Not yet What Is ZCRX? io_uring’s ZCRX (zero-copy receive) is a subsystem new to Linux 6.15 that lets userspace receive network packets directly into a registered memory region — no kernel copy needed. The NIC DMAs into the region, the kernel posts a completion event, and the user returns the slot when done via a refill queue. ...