Back to CVE records
Medium 5.5Published Mar 18, 2026
CVE-2026-23263io_uring/zcrx: fix page array leak
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Start free and add your stack
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix page array leak d9f595b9a65e ("io_uring/zcrx: fix leaking pages on sg init fail") fixed a page leakage but didn't free the page array, release it as well.
- CVSS
- 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Analyzed
- Record last updated
- May 11, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from b84621d96ee0221e0bfbf9f477bbec7a5077c464 before 64cf3016234ce8a6e4195ed1b2d9e2a1ae41b57d; from b84621d96ee0221e0bfbf9f477bbec7a5077c464 before 0ae91d8ab70922fb74c22c20bedcb69459579b1c | CNA record |
linux linux_kernel linux:linux_kernel | from 6.17 before 6.18.10; 6.19; 6.19; 6.19; 6.19; 6.19; 6.19; 6.19; and 1 more ranges | NVD |
References
- https://git.kernel.org/stable/c/64cf3016234ce8a6e4195ed1b2d9e2a1ae41b57dpatch
- https://git.kernel.org/stable/c/0ae91d8ab70922fb74c22c20bedcb69459579b1cpatch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.