Executive brief
The Linux kernel's io_uring subsystem contains a memory leak in the command handling path. When NVMe passthrough commands or other async operations use cached io_async_cmd structures with large iovec arrays, the memory is not properly freed once the internal cache becomes full, leading to a gradual loss of system memory over time.
Technical details
The vulnerability exists in io_uring/cmd's handling of iovec arrays within io_async_cmd structures. When an iovec array grows and is allocated dynamically, it is carried across command recycling through ctx->cmd_cache. However, the cleanup path fails to free this iovec in two scenarios: (1) when io_alloc_cache_put() fails after the cache reaches its 128-entry limit, and (2) when REQ_F_NEED_CLEANUP is not set for reused cached vectors. The root cause is that io_uring_cmd_prep() does not flag inherited vectors for cleanup, unlike io_rw_alloc_async() and io_msg_alloc_async(). NVMe passthrough workloads trigger this through nvme_uring_cmd_io() returning -EIOCBQUEUED, causing the io_async_cmd to persist for the command's lifetime. The fix involves flagging inherited vectors in io_uring_cmd_prep() and freeing the iovec when cache put fails.
Affected products
- Linux Linux kernel affected versions unspecified
Timeline
- 2026-09-04: disclosed