CVE-2026-64426

Awaiting Analysis Awaiting Analysis - Queue

File Reference Leak in Linux Kernel io_uring

Publication date: 2026-07-25

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE NOP file-acquisition support choses between a fixed (registered) file and a normal fget()'d file based on its own IORING_NOP_FIXED_FILE flag in sqe->nop_flags. However, a request's REQ_F_FIXED_FILE is set independently from the generic IOSQE_FIXED_FILE sqe flag during request init, before the issue handler runs. If a NOP is submitted with IOSQE_FIXED_FILE set (so REQ_F_FIXED_FILE is set) but without IORING_NOP_FIXED_FILE, io_nop() takes the normal path and grabs a real reference via io_file_get_normal(). On completion, io_put_file() only drops the reference when REQ_F_FIXED_FILE is clear, so the fget()'d file is never released and leaks: BUG: memory leak unreferenced object 0xffff88800f42c240 (size 176): kmem_cache_alloc_noprof+0x358/0x440 alloc_empty_file+0x57/0x180 path_openat+0x44/0x1e50 do_file_open+0x121/0x200 do_sys_openat2+0xa7/0x150 __x64_sys_openat+0x82/0xf0 Decide between fixed and normal file acquisition from REQ_F_FIXED_FILE, the same way io_assign_file() does for every other opcode, and fold IORING_NOP_FIXED_FILE into REQ_F_FIXED_FILE at prep time.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-11

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64426

EUVD

EUVD-2026-48770

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a file reference leak in the io_uring subsystem. Specifically, when a NOP operation is submitted with the IOSQE_FIXED_FILE flag set but without the IORING_NOP_FIXED_FILE flag, the system incorrectly acquires a file reference via fget() instead of using a fixed file. The reference is never released, causing a memory leak.

Detection Guidance

This vulnerability is specific to the Linux kernel's io_uring subsystem and does not have a direct network detection method. To check for affected systems, verify if your Linux kernel version includes the vulnerable code path. Use commands like 'uname -r' to check the kernel version and 'grep -r IOSQE_FIXED_FILE /usr/src/linux-headers-$(uname -r)/' to inspect io_uring flags. If the kernel version is vulnerable, look for memory leaks in io_uring operations.

Impact Analysis

This vulnerability can lead to memory leaks, which may cause system instability or performance degradation over time due to unaccounted memory usage. It could potentially lead to denial-of-service conditions if the system runs out of memory.

Compliance Impact

This vulnerability is a memory leak in the Linux kernel's io_uring subsystem, specifically related to file reference handling. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection, privacy, and security controls rather than kernel-level memory management issues.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch the io_uring file reference leak. If immediate patching is not possible, disable io_uring by setting 'kernel.io_uring_disabled=1' via sysctl or remove io_uring modules. Monitor system memory usage for leaks and restart services using io_uring to clear any residual issues.

Hi! I’m here to help you understand CVE-2026-64426. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70