Skip to content
snailsploit[$]
CVE Disclosure

CVE-2026-43121

Linux Kernel io_uring/zcrx

user_ref race → double-free → OOB write

CVSS4.7
SeverityMedium
StatusPublished

Summary

CVE-2026-43121 is a medium-severity vulnerability affecting Linux Kernel io_uring/zcrx: user_ref race → double-free → OOB write.

References

NVD↗MITRE↗Vendor / Advisory↗PoC repo (if published)↗

Disclosure

Reported by Kai Aizen. Status: Published. Coordinated through standard NVD/MITRE/GHSA channels.

disclosure contextall 66 cves →
all disclosures
CVE Ledger →
66 published CVEs
advisories
GHSA disclosures →
7 coordinated advisories
engage
Pen Testing →
same methodology, your stack
Author
Kai Aizen
Independent Adversarial · Research group. 66 published CVEs, 5 Linux kernel mainline patches, creator of AATMF / P.R.O.M.P.T / SEF, author of Adversarial Minds.
aboutservicesresearchgate
Quick facts
ID
CVE-2026-43121
Product
Linux kernel (io_uring zerocopy receive)
Severity
4.7 · Medium
Class
CWE-362
Affected: Linux kernel versions exposing io_uring zcrx with the unsynchronised user_refs path; see upstream commit for exact range
References: NVD · MITRE · Vendor advisory
Frequently asked

CVE-2026-43121 — questions & answers

What is CVE-2026-43121?

CVE-2026-43121 is a race condition in the Linux kernel's io_uring zerocopy-receive (zcrx) path. Operations on user_refs were not atomic, so concurrent threads can race the reference count to zero twice, producing a double-free that can be steered into an out-of-bounds write.

Am I affected by CVE-2026-43121?

You are affected if your Linux kernel exposes io_uring zcrx and is older than the upstream fix. Cloud and container hosts running unprivileged workloads with io_uring enabled are the primary risk. Distributions ship backported fixes — apply the kernel update from your vendor.

How do I fix CVE-2026-43121?

Apply the upstream fix that converts user_refs operations to atomic primitives (mainline commit by Kai Aizen). On systems where a kernel upgrade is not immediately possible, restrict io_uring usage via /proc/sys/kernel/io_uring_disabled, by namespace policy, or by seccomp filtering of io_uring_setup() for untrusted workloads.

What is the impact of CVE-2026-43121?

Local privilege escalation primitive — double-free plus OOB write in kernel memory. CVSS 4.7 Medium; exploitation complexity is high but the resulting primitive is powerful.

Where can I find authoritative references?

Upstream mainline commit on git.kernel.org, NVD at https://nvd.nist.gov/vuln/detail/CVE-2026-43121, MITRE CVE record, and the snailsploit writeup at /security-research/general/io-uring-zcrx-race-condition/.