CVE-2026-23263: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23263 is a memory leak vulnerability in the Linux kernel's io_uring/zcrx (zero-copy RX) subsystem where a page array is not properly freed when scatter-gather list initialization fails. The flaw was introduced as an incomplete fix — a prior patch (commit d9f595b9a65e) addressed page leakage on sg init failure but neglected to release the page array itself. It affects Linux kernel versions from 6.17 up to (but not including) 6.18.10, as well as 6.19 release candidates (rc1 through rc8). Disclosed on March 18, 2026, it carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In the io_uring/zcrx code path, when scatter-gather list initialization fails, the previously allocated page array is not freed, resulting in a kernel memory leak. An attacker or unprivileged local user can repeatedly trigger this failure condition during io_uring zero-copy RX operations, causing cumulative memory exhaustion. The fix involves explicitly releasing the page array in the error handling path, as implemented in upstream commits 0ae91d8ab709 and 64cf3016234c (Red Hat Bugzilla, Kernel Patch 1, Kernel Patch 2).

Successful exploitation allows a local user with low privileges to cause a denial of service by exhausting kernel memory. By repeatedly triggering scatter-gather list initialization failures in io_uring zero-copy RX operations, the attacker causes the kernel to permanently leak page array allocations, eventually degrading or crashing the system. There is no confidentiality or integrity impact; the vulnerability is limited to availability (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires local access with low privileges and is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, reflecting a very low probability of exploitation in the near term (Red Hat Advisory).

Update the Linux kernel to version 6.18.10 or later, which includes the upstream fix. The patches are available at kernel stable commits 0ae91d8ab709 and 64cf3016234c. As a workaround, administrators can restrict io_uring access to trusted users using seccomp filters, Linux Security Modules (e.g., SELinux/AppArmor), or by setting kernel.io_uring_disabled=1 via sysctl where operationally feasible (Red Hat Advisory, Kernel Patch 1, Kernel Patch 2).