CVE-2026-45995: io_uring/zcrx: fix user_struct uaf

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-27 · updated 2026-06-17
Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix user_struct uaf io_free_rbuf_ring() usees a struct user_struct, which io_zcrx_ifq_free() puts it down before destroying the ring.

Affected products

Linux kernel: from 6.19 before 7.0.4 — fixed in 7.0.4

How to fix

Upgrade to a fixed version: Linux kernel 7.0.4. Check the vendor advisory for mitigations.

References

https://git.kernel.org/stable/c/0fcccfd87152f957fa8312b841f6efef42a05a20
https://git.kernel.org/stable/c/9feb88eeda6d288f93fcfb6bca563f89e316479d

Get alerted when CVE-2026-45995 or the next vulnerability affects your stack