Medium 5.5Published May 6, 2026

CVE-2026-43224io_uring/zcrx: fix sgtable leak on mapping failures

Updated under an hour ago (Oct 28, 2026, 5:00 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix sgtable leak on mapping failures In an unlikely case when io_populate_area_dma() fails, which could only happen on a PAGE_POOL_32BIT_ARCH_WITH_64BIT_DMA machine, io_zcrx_map_area() will have an initialised and not freed table. It was supposed to be cleaned up in the error path, but !is_mapped prevents that.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 439a98b972fbb1991819b5367f482cd4161ba39c before f1ae403324311e143ef20e53cf9a5f01e312f7c9; from 439a98b972fbb1991819b5367f482cd4161ba39c before ef075c1464ac9047e2cf7d23cb020bfd0b8e4b60; from 439a98b972fbb1991819b5367f482cd4161ba39c before a983aae397767e9da931128ff2b5bf9066513ce3	CNA record
linux linux_kernel linux:linux_kernel	from 6.18 before 6.18.16; from 6.19 before 6.19.6	NVD

References

References

https://git.kernel.org/stable/c/f1ae403324311e143ef20e53cf9a5f01e312f7c9	patch
https://git.kernel.org/stable/c/ef075c1464ac9047e2cf7d23cb020bfd0b8e4b60	patch
https://git.kernel.org/stable/c/a983aae397767e9da931128ff2b5bf9066513ce3	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.