user_ref race → double-free → OOB write
io_uring/zcrx contains: user_ref race → double-free → OOB write. Reported, root-cause analyzed, patch submitted, accepted, and merged into Linus's tree through the standard kernel maintainer process. Status: Mainline 7.0-rc1 · backports 6.18.16 + 6.19.6.
Authoritative sources for the patch and discussion:
This patch is one of five mainline contributions spanning networking, IPC, Bluetooth, RDMA, and io_uring. For broader vulnerability research see 23 published CVEs and research.