[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20260507174811.GA4838@openwall.com>
Date: Thu, 7 May 2026 19:48:11 +0200
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Cc: Mohamed salem Eddah <medsalemeddah@...il.com>, security@...nel.org,
"axboe@...nel.dk" <axboe@...nel.dk>
Subject: Re: CVE request: io_uring zcrx freelist OOB write
On Mon, May 04, 2026 at 07:02:30AM +0100, Pavel Begunkov wrote:
> On 5/3/26 12:00, Mohamed salem Eddah wrote:
> >I am reporting a security issue in the Linux kernel involving an
> >out-of-bounds heap write in io_uring/zcrx.c.
> >
> >This issue appears to have been addressed in commit 770594e
> >(“io_uring/zcrx: warn on freelist violations”, April 21, 2026),
> >however it
> >was not assigned a CVE and does not appear to have been included in a
> >formal security advisory. As a result, multiple stable and downstream
> >distribution kernels are still affected.
> >------------------------------
> >Vulnerability Summary
> >
> >*File:* io_uring/zcrx.c
> >*Function:* io_zcrx_return_niov_freelist()
> >*Introduced:* Linux 6.12 (initial ZCRX merge)
>
> FWIW, it was added IIRC in 6.15, but not 6.12
>
> >*Fixed upstream:* 770594e (Apr 21, 2026)
> >*Status:* Fix not yet present in stable releases
> Did you trigger the problem or the warning in a new kernel
> without the attached modules? Which kernel version / hash
> was it? There was a fix for the scrub case, but otherwise
> don't immediately see how that can happen. I'll take a look.
I only skimmed, but as far as I can tell Mohamed isn't the original
finder of this issue and the report and PoCs are AI-generated, which
could be why Mohamed is not communicating further. It's becoming a
trend - someone sends AI-generated report and doesn't communicate.
Which doesn't mean the report is useless, but it does complicate its
handling.
Meanwhile, it looks like there's a blog post (by someone else? I am
confused) on exploitation of this issue, with exploit files attached:
https://ze3tar.github.io/post-zcrx.html
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
