CVE-2026-64426: io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE

Published Jul 25, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

iouring/nop: fix file reference leak with IOSQEFIXEDFILE

NOP file-acquisition support choses between a fixed (registered) file and a normal fget()'d file based on its own IORINGNOPFIXEDFILE flag in sqe->nopflags. However, a request's REQFFIXEDFILE is set independently from the generic IOSQEFIXEDFILE sqe flag during request init, before the issue handler runs.

If a NOP is submitted with IOSQEFIXEDFILE set (so REQFFIXEDFILE is set) but without IORINGNOPFIXEDFILE, ionop() takes the normal path and grabs a real reference via iofilegetnormal(). On completion, ioputfile() only drops the reference when REQFFIXEDFILE is clear, so the fget()'d file is never released and leaks:

BUG: memory leak unreferenced object 0xffff88800f42c240 (size 176): kmemcacheallocnoprof+0x358/0x440 allocemptyfile+0x57/0x180 pathopenat+0x44/0x1e50 dofileopen+0x121/0x200 dosysopenat2+0xa7/0x150 x64sysopenat+0x82/0xf0

Decide between fixed and normal file acquisition from REQFFIXEDFILE, the same way ioassignfile() does for every other opcode, and fold IORINGNOPFIXEDFILE into REQFFIXEDFILE at prep time.

Affected Software

3 affected components
Linux Linux kernel
Linux Linux kernel>=6.13<6.18.39
Linux Linux kernel>=6.19<7.1.4

Event History

Jul 25, 2026
CVE Published
via MITRE·08:51 AM
Data Sourced
via MITRE·08:51 AM
Description
Data Sourced
via NVD·10:17 AM
RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

1

What level of access does an attacker need?

Exploitation requires local access and low privileges. No user interaction is required.

2

What is the likely operational impact?

The flaw can leak file references, producing a memory leak. The assigned CVSS vector indicates a high availability impact, so repeated exploitation could degrade system availability.

3

What should teams do to remediate this issue?

A patch is available. Apply a kernel update containing the fix referenced by the listed stable kernel commits.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203