In the Linux kernel, the following vulnerability has been resolved:
io_uring/zcrx: fix sgtable leak on mapping failures
In an unlikely case when iopopulateareadma() fails, which could only happen on a PAGEPOOL32BITARCHWITH64BITDMA machine, iozcrxmaparea() will have an initialised and not freed table. It was supposed to be cleaned up in the error path, but !is_mapped prevents that.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43224.json",
"cna_assigner": "Linux"
}