PT-2026-37564 · Linux · Linux Kernel

Published 2026-05-06 · Updated 2026-05-08 · CVE-2026-43224

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory leak occurs in the io uring/zcrx component. Specifically, when the io populate area dma() function fails on a PAGE POOL 32BIT ARCH WITH 64BIT DMA machine, the io zcrx map area() function leaves an initialized table that is not freed. This happens because the !is mapped condition prevents the necessary cleanup in the error path.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2026-43224

Affected Products

Linux Kernel

References · 11

• https://ubuntu.com/security/CVE-2026-43224 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43224 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-43224 · Vendor Advisory
• https://git.kernel.org/stable/c/a983aae397767e9da931128ff2b5bf9066513ce3 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43224 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43224 · Vendor Advisory
• https://git.kernel.org/stable/c/ef075c1464ac9047e2cf7d23cb020bfd0b8e4b60 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43224 · Security Note
• https://git.kernel.org/stable/c/f1ae403324311e143ef20e53cf9a5f01e312f7c9 · Patch
• https://t.me/cveNotify/162802 · Telegram Post
• https://git.kernel.org/linus/a983aae397767e9da931128ff2b5bf9066513ce3 · Note