Skip to main content

Linux Kernel CVE-2026-64426

| EUVDEUVD-2026-48770 MEDIUM
2026-07-25 Linux GHSA-w7v4-jwp5-gr92
Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local unprivileged io_uring access required (PR:L, AV:L); impact is purely resource exhaustion with no confidentiality or integrity consequence (C:N/I:N/A:H).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Metadata Corrected
Sep 04, 2026 - 17:40 vuln.today
tag: Information Disclosure removed
Analysis Generated
Sep 04, 2026 - 17:17 vuln.today
CVSS changed
Sep 04, 2026 - 15:07 NVD
5.5 (MEDIUM)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:51 nvd
MEDIUM 5.5
CVE Published
Jul 25, 2026 - 08:51 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE

NOP file-acquisition support choses between a fixed (registered) file and a normal fget()'d file based on its own IORING_NOP_FIXED_FILE flag in sqe->nop_flags. However, a request's REQ_F_FIXED_FILE is set independently from the generic IOSQE_FIXED_FILE sqe flag during request init, before the issue handler runs.

If a NOP is submitted with IOSQE_FIXED_FILE set (so REQ_F_FIXED_FILE is set) but without IORING_NOP_FIXED_FILE, io_nop() takes the normal path and grabs a real reference via io_file_get_normal(). On completion, io_put_file() only drops the reference when REQ_F_FIXED_FILE is clear, so the fget()'d file is never released and leaks:

BUG: memory leak unreferenced object 0xffff88800f42c240 (size 176): kmem_cache_alloc_noprof+0x358/0x440 alloc_empty_file+0x57/0x180 path_openat+0x44/0x1e50 do_file_open+0x121/0x200 do_sys_openat2+0xa7/0x150 __x64_sys_openat+0x82/0xf0

Decide between fixed and normal file acquisition from REQ_F_FIXED_FILE, the same way io_assign_file() does for every other opcode, and fold IORING_NOP_FIXED_FILE into REQ_F_FIXED_FILE at prep time.

AnalysisAI

Resource exhaustion via file reference leak in the Linux kernel's io_uring NOP opcode handler allows a local, low-privileged user to gradually exhaust kernel memory. The flaw occurs when a NOP submission carries the generic IOSQE_FIXED_FILE sqe flag (setting REQ_F_FIXED_FILE) but omits the NOP-specific IORING_NOP_FIXED_FILE flag in nop_flags: io_nop() acquires a real file reference via io_file_get_normal(), yet io_put_file() skips releasing it because REQ_F_FIXED_FILE is set, producing one leaked 176-byte kernel file object per operation. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The Linux kernel's io_uring subsystem (introduced in 5.1) provides a high-performance asynchronous I/O interface via shared ring buffers. The NOP opcode in io_uring/nop.c is a benchmarking and testing primitive that can optionally acquire a file reference. Two independent flag systems govern this behaviour: the generic IOSQE_FIXED_FILE submission queue entry flag (which sets the per-request REQ_F_FIXED_FILE bit during request initialization, before any opcode handler runs) and the NOP-specific IORING_NOP_FIXED_FILE bit in sqe->nop_flags (consulted at issue time inside io_nop()). When these diverge - IOSQE_FIXED_FILE set but IORING_NOP_FIXED_FILE absent - io_nop() follows the normal-file path and calls io_file_get_normal(), incrementing the file's reference count, while io_put_file() at completion time suppresses the corresponding decrement because REQ_F_FIXED_FILE is set. The fix folds IORING_NOP_FIXED_FILE into REQ_F_FIXED_FILE at prep time and drives file acquisition from REQ_F_FIXED_FILE, matching the behaviour of io_assign_file() for all other opcodes. CWE is listed as N/A but the root cause maps to CWE-401 (Missing Release of Memory after Effective Lifetime).

RemediationAI

Upgrade to a fixed Linux kernel release: 6.18.39, 7.1.4, or 7.2-rc1 contain the corrections (upstream stable commits 722869fc, 7267717f, and 2564ca2e at git.kernel.org/stable/c/). Linux distribution vendors (Debian, Ubuntu, RHEL, SUSE, Arch, etc.) should be checked for backported kernel packages addressing this commit range. Where immediate patching is not feasible, disabling io_uring system-wide via the sysctl knob (setting /proc/sys/kernel/io_uring_disabled to 1 to disable for unprivileged users, or 2 to disable entirely) prevents exploitation but breaks any workloads that depend on io_uring for high-performance asynchronous I/O. Container and sandbox environments enforcing seccomp profiles that block the io_uring_setup(2) syscall are also protected without kernel upgrade.

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

Share

CVE-2026-64426 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy