CVE-2026-45995 Overview
CVE-2026-45995 is a use-after-free vulnerability in the Linux kernel's io_uring zero-copy receive (zcrx) subsystem. The flaw resides in the interaction between io_free_rbuf_ring() and io_zcrx_ifq_free(). The function io_free_rbuf_ring() references a struct user_struct, but io_zcrx_ifq_free() releases that reference before the ring is destroyed. This ordering bug leaves io_free_rbuf_ring() operating on freed memory during teardown of the zcrx interface queue [CWE-416].
Critical Impact
Local processes interacting with io_uring zcrx interface queues may trigger memory corruption inside the kernel, with potential for denial of service or local privilege escalation.
Affected Products
- Linux kernel versions containing the io_uring/zcrx zero-copy receive feature
- Distributions shipping the affected kernel before stable backports 0fcccfd87152 and 9feb88eeda6d
- Server, container, and workstation deployments using io_uring workloads
Discovery Timeline
- 2026-05-27 - CVE-2026-45995 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45995
Vulnerability Analysis
The Linux kernel's io_uring subsystem provides asynchronous I/O through shared submission and completion rings. The zcrx (zero-copy receive) extension allows applications to receive network data directly into user-mapped buffers. To track per-user resource accounting, zcrx holds a reference to a struct user_struct.
During interface queue teardown, io_zcrx_ifq_free() drops the user_struct reference before invoking io_free_rbuf_ring(). The ring release path then dereferences fields associated with that already-released user_struct. If the reference count reaches zero between the put and the subsequent ring free, the kernel accesses freed memory.
Root Cause
The defect is a cleanup ordering error. The lifetime of user_struct must outlast any code path that reads it, but the teardown sequence inverts that requirement. The upstream fix reorders teardown so that io_free_rbuf_ring() completes before the user_struct reference is released. See the kernel commits 0fcccfd87152 and 9feb88eeda6d for the applied corrections.
Attack Vector
Exploitation requires local code execution with the ability to create and destroy io_uring instances configured for zcrx. An attacker repeatedly creates and tears down zcrx interface queues to race the user_struct release against the ring free path. Successful triggering produces kernel memory corruption that can be shaped into a denial of service or, with additional primitives, leveraged toward privilege escalation. No verified public proof-of-concept is referenced in the advisory data.
Detection Methods for CVE-2026-45995
Indicators of Compromise
- Kernel oops or panic messages referencing io_free_rbuf_ring, io_zcrx_ifq_free, or free_uid in dmesg output
- KASAN use-after-free reports tagged with user_struct allocations on kernels built with sanitizers enabled
- Unexpected process terminations originating from io_uring_setup workloads
Detection Strategies
- Inventory running kernel versions and compare against the patched commits to identify exposed hosts
- Audit which workloads invoke io_uring_setup with zcrx-related opcodes using auditd or eBPF tracing
- Alert on repeated io_uring create and teardown cycles from non-privileged processes, which can indicate race exploitation attempts
Monitoring Recommendations
- Forward dmesg, journald, and kdump artifacts to a centralized log store for retroactive crash analysis
- Enable KASAN in test environments to surface use-after-free conditions during fuzzing
- Track io_uring syscall telemetry with eBPF probes to baseline legitimate use and flag anomalies
How to Mitigate CVE-2026-45995
Immediate Actions Required
- Apply the stable kernel updates containing commits 0fcccfd87152 and 9feb88eeda6d from your distribution vendor
- Reboot affected systems after installing the patched kernel so the fix takes effect
- Restrict io_uring usage to trusted workloads where patching cannot be performed immediately
Patch Information
The vulnerability is resolved upstream by reordering the teardown logic so that io_free_rbuf_ring() runs before the user_struct reference is released. Patched commits are available at git.kernel.org commit 0fcccfd87152 and git.kernel.org commit 9feb88eeda6d. Distribution maintainers will ship the fix in stable kernel updates.
Workarounds
- Disable io_uring for unprivileged users by setting kernel.io_uring_disabled=2 via sysctl where the workload allows
- Use seccomp profiles to block the io_uring_setup syscall for untrusted containers and processes
- Restrict execution of untrusted local binaries on multi-tenant hosts until the kernel is patched
# Disable io_uring for unprivileged users until the patched kernel is deployed
sudo sysctl -w kernel.io_uring_disabled=2
echo 'kernel.io_uring_disabled=2' | sudo tee /etc/sysctl.d/99-io_uring.conf
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
