CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure
In the Linux kernel, the following vulnerability has been resolved:
iouring/rw: free potentially allocated iovec on cache put failure
If a read/write request goes through ioreqrwcleanup() and has an allocated iovec attached and fails to put to the rwcache, then it may end up with an unaccounted iovec pointer. Have iorwrecycle() return whether it recycled the request or not, and use that to gauge whether to free a potential iovec or not.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23259?
CVE-2026-23259 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2026-23259?
To fix CVE-2026-23259, upgrade your Linux kernel to a version that includes the patch for this vulnerability.
What type of system is affected by CVE-2026-23259?
CVE-2026-23259 affects the Linux kernel across various Linux distributions that utilize the affected kernel versions.
What is the impact of CVE-2026-23259?
The impact of CVE-2026-23259 may include potential memory corruption issues due to a failure to free allocated iovec on cache put failure.
When was CVE-2026-23259 reported?
CVE-2026-23259 was reported in 2026 and has been included in the Linux kernel's security advisories.