Linux Kernel io_uring Sgtable Leak Vulnerability in zcrx Component

A vulnerability exists in the Linux kernel's io_uring/zcrx component, where a mapping failure can lead to a memory leak. This issue arises on machines with PAGE_POOL_32BIT_ARCH_WITH_64BIT_DMA, causing the io_zcrx_map_area() function to leave an initialized scatter-gather table unfreed. The table was intended to be cleared in the error handling process, but the condition '!is_mapped' prevents this cleanup.

Impact

The vulnerability can cause a memory leak by failing to properly free an initialized scatter-gather table after a mapping error, potentially leading to increased memory usage.

Reproduction

The vulnerability can be reproduced by triggering a mapping failure in the io_uring/zcrx component on a machine with PAGE_POOL_32BIT_ARCH_WITH_64BIT_DMA. This failure will cause the io_zcrx_map_area() function to leave an initialized scatter-gather table unfreed, creating a memory leak.

Remediation

Users can apply the patch available in the Linux kernel stable tree to address this vulnerability.