Skip to main content

Linux EUVDEUVD-2026-12892

| CVE-2026-23259 MEDIUM
2026-03-18 Linux
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
View

Vulnerability Assessment

Impact

While no CVSS score or EPSS data are currently available for this CVE, the vulnerability presents a moderate local denial-of-service risk. The attack vector is local (requires local system access to trigger io_uring operations), likely requires unprivileged user privileges, and the technical impact is limited to availability (memory exhaustion). The vulnerability is NOT marked as actively exploited in known vulnerability databases (no KEV status provided), and no public proof-of-concept exploit is referenced. However, the fact that stable kernel commits exist (1d5f2329ab4df65c2ee011b986d8a6e05ad0f67c and 4b9748055457ac3a0710bf210c229d01ea1b01b9) indicates this was a real issue discovered through code analysis rather than active exploitation. The real-world priority is moderate because exploitation requires specific io_uring usage patterns that stress the cache recycling path, limiting the attack surface compared to more directly exploitable kernel vulnerabilities.
Exploit ScenarioDerived

A local unprivileged attacker could repeatedly submit read/write requests through io_uring with specific patterns designed to trigger cache recycling failures. As each failed recycle operation leaks an iovec allocation, the attacker gradually exhausts kernel memory through repeated io_uring operations. After sufficient iterations, the kernel memory pressure becomes severe enough to degrade system performance, trigger out-of-memory conditions, and force the kernel to kill critical processes, achieving a denial of service condition. No public exploit code is known, but the vulnerability is straightforward to trigger for an attacker with local shell access and knowledge of io_uring system call patterns.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 18, 2026

A memory management vulnerability exists in the Linux kernel's io_uring subsystem where allocated iovec buffers may fail to be properly freed when a read/write request cannot be recycled back to the rw_cache. This affects all Linux kernel versions with the vulnerable io_uring/rw code path, potentially allowing local attackers to trigger memory leaks that degrade system performance or enable denial of service conditions. The vulnerability has been patched in the Linux kernel stable trees as evidenced by the provided commit references.

RemediationAI

Apply the Linux kernel security patches referenced in the stable kernel trees: commit 1d5f2329ab4df65c2ee011b986d8a6e05ad0f67c or 4b9748055457ac3a0710bf210c229d01ea1b01b9 from git.kernel.org/stable. For end users, upgrade to a kernel version that includes this patch through your distribution's package manager (e.g., apt update && apt upgrade linux-image for Debian/Ubuntu, yum update kernel for RHEL/CentOS). Verify the patch is included by checking kernel release notes or using uname -r to confirm the installed version. Until patching is possible, limit local system access and monitor memory usage patterns for anomalies that might indicate io_uring cache exhaustion. The kernel maintainers have already resolved this issue, so patches should be available in recent stable kernel releases and distribution updates.

Affected VersionsENISA

Linux patch: 6.18.10
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <1d5f2329ab4df65c2ee011b986d8a6e05ad0f67c
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <4b9748055457ac3a0710bf210c229d01ea1b01b9
Linux patch: 6.19

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in the Linux kernel's io_uring subsystem (CPE: cpe:2.3:a:linux:linux), specifically in the io_uring/rw read/write request handling code. The io_uring interface provides asynchronous I/O capabilities by managing request buffers and recycling mechanisms through an rw_cache pool. The io_req_rw_cleanup() function is responsible for cleaning up completed read/write requests and potentially freeing associated iovec structures (input/output vector arrays used for scatter-gather I/O). The root cause is a resource management error (related to CWE-399: Resource Management Errors or CWE-401: Missing Release of Memory after Effective Lifetime) where the io_rw_recycle() function did not properly communicate whether recycling succeeded, leaving callers unable to determine if manual iovec deallocation was necessary. When recycling to the cache fails, the allocated iovec pointer becomes unaccounted, resulting in a memory leak that accumulates with each failed recycling attempt.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE MEDIUM
Red Hat 5.5 LOW

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
CVSS changed
May 29, 2026 - 19:07 NVD
5.5 (MEDIUM)
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Mar 18, 2026 - 17:41 nvd
N/A

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

io_uring/rw: free potentially allocated iovec on cache put failure

If a read/write request goes through io_req_rw_cleanup() and has an allocated iovec attached and fails to put to the rw_cache, then it may end up with an unaccounted iovec pointer. Have io_rw_recycle() return whether it recycled the request or not, and use that to gauge whether to free a potential iovec or not.

Threat Intelligence Overview

EPSS Score
0.0%
Top 96% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Related Vulnerabilities in Linux Kernel I/O and Data Structure Fixes

View all 4
CVE-2026-23260 MEDIUM
5.5
CVE-2026-23263
CVE-2026-23261 MEDIUM
5.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

Debian

linux
Release Status Fixed Version Urgency
bullseye vulnerable 5.10.223-1 -
bullseye (security) vulnerable 5.10.251-1 -
bookworm vulnerable 6.1.159-1 -
bookworm (security) vulnerable 6.1.164-1 -
trixie vulnerable 6.12.73-1 -
trixie (security) vulnerable 6.12.74-2 -
forky fixed 6.19.6-2 -
sid fixed 6.19.8-1 -
(unstable) fixed 6.18.10-1 -

SUSE

Severity: Medium
Product Status
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-EC2 Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-GCE-3P Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-GCE-3P Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-23259 ADVISORY https://vuldb.com/?id.351574 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1573/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1661/ REF https://git.kernel.org/stable/c/1d5f2329ab4df65c2ee011b986d8a6e05ad0f67c REF https://git.kernel.org/stable/c/41cda4c66846c3bfcdeaf28444ccabbb55e64cf1 REF https://git.kernel.org/stable/c/4b9748055457ac3a0710bf210c229d01ea1b01b9

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy