Linux io_uring: NOP with IOSQE_FIXED_FILE leaks a struct file reference on every submission

CVSS 5.5CVE-2026-64426Kernel, userspace & hypervisorcurated

Impact

io_nop() decided between a registered file and a real fget() using its own IORING_NOP_FIXED_FILE flag, while the generic IOSQE_FIXED_FILE sqe flag had already set REQ_F_FIXED_FILE on the request. Submitting a NOP with IOSQE_FIXED_FILE but without IORING_NOP_FIXED_FILE takes a genuine file reference on submit that io_put_file() then declines to drop, so each submission permanently leaks a struct file. Any unprivileged process that can create an io_uring ring can repeat this in a tight loop and exhaust kernel memory on the node. On a shared GPU node that is one tenant pod turning a whole box, and every co-tenant's job on it, into an out-of-memory event, and the box then needs a drain and reboot to recover cleanly.

Who can reach it

Local unprivileged user, including any tenant in a container whose seccomp policy still permits io_uring_setup and io_uring_enter. No special capability or device access is needed.

What to do

Update to a stable kernel carrying the fix and reboot each node; the kernel CNA published three stable commits and no fixed version string, so match the commits below to your branch. If you cannot reboot soon, the standard mitigation applies: block io_uring syscalls for tenant workloads via seccomp, or set kernel.io_uring_disabled=2 on nodes where no workload needs it.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-64426 https://git.kernel.org/stable/c/2564ca2e31bd8ee8348362941af2ee4671e487ca https://git.kernel.org/stable/c/722869fcff598fad20d5ab79c305897a7534708b https://git.kernel.org/stable/c/7267717f35787167fcce4bc14f6ef3fa06682dcf

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.