CVE-2026-64426: io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE
In the Linux kernel, the following vulnerability has been resolved:
iouring/nop: fix file reference leak with IOSQEFIXEDFILE
NOP file-acquisition support choses between a fixed (registered) file and a normal fget()'d file based on its own IORINGNOPFIXEDFILE flag in sqe->nopflags. However, a request's REQFFIXEDFILE is set independently from the generic IOSQEFIXEDFILE sqe flag during request init, before the issue handler runs.
If a NOP is submitted with IOSQEFIXEDFILE set (so REQFFIXEDFILE is set) but without IORINGNOPFIXEDFILE, ionop() takes the normal path and grabs a real reference via iofilegetnormal(). On completion, ioputfile() only drops the reference when REQFFIXEDFILE is clear, so the fget()'d file is never released and leaks:
BUG: memory leak unreferenced object 0xffff88800f42c240 (size 176): kmemcacheallocnoprof+0x358/0x440 allocemptyfile+0x57/0x180 pathopenat+0x44/0x1e50 dofileopen+0x121/0x200 dosysopenat2+0xa7/0x150 x64sysopenat+0x82/0xf0
Decide between fixed and normal file acquisition from REQFFIXEDFILE, the same way ioassignfile() does for every other opcode, and fold IORINGNOPFIXEDFILE into REQFFIXEDFILE at prep time.
Affected Software
Remediation
Event History
Frequently Asked Questions
What level of access does an attacker need?
Exploitation requires local access and low privileges. No user interaction is required.
What is the likely operational impact?
The flaw can leak file references, producing a memory leak. The assigned CVSS vector indicates a high availability impact, so repeated exploitation could degrade system availability.
What should teams do to remediate this issue?
A patch is available. Apply a kernel update containing the fix referenced by the listed stable kernel commits.