Executive brief
A vulnerability in the Linux kernel's high-performance I/O framework (io_uring) could allow a local user to cause a system memory leak. This occurs when certain data structures used for read/write operations are not properly cleaned up after a failure. Over time, this could lead to resource exhaustion and system instability or a denial-of-service condition.
Technical details
A memory leak exists in the io_uring/rw component of the Linux kernel. When a read/write request undergoes cleanup via io_req_rw_cleanup(), it may have an allocated iovec attached. If the request fails to be placed back into the rw_cache via io_rw_recycle(), the associated iovec pointer remains unaccounted for and is not freed. This vulnerability can be triggered by a local attacker to exhaust system memory. The fix involves modifying io_rw_recycle() to return a boolean status indicating whether recycling was successful, allowing the caller to explicitly free the iovec if recycling fails. Patches have been released for stable kernel branches.
Affected products
- Linux Linux Kernel 6.10 to 6.18.10
Timeline
- 2026-01-18: other: Patch authored by Jens Axboe
- 2026-03-18: disclosed
- 2026-03-18: advisory