Linux EUVD-2026-12892

The vulnerability resides in the Linux kernel's io_uring subsystem (CPE: cpe:2.3:a:linux:linux), specifically in the io_uring/rw read/write request handling code. The io_uring interface provides asynchronous I/O capabilities by managing request buffers and recycling mechanisms through an rw_cache pool. The io_req_rw_cleanup() function is responsible for cleaning up completed read/write requests and potentially freeing associated iovec structures (input/output vector arrays used for scatter-gather I/O). The root cause is a resource management error (related to CWE-399: Resource Management Errors or CWE-401: Missing Release of Memory after Effective Lifetime) where the io_rw_recycle() function did not properly communicate whether recycling succeeded, leaving callers unable to determine if manual iovec deallocation was necessary. When recycling to the cache fails, the allocated iovec pointer becomes unaccounted, resulting in a memory leak that accumulates with each failed recycling attempt.