{"id":"CVE-2026-64426","title":"io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/nop: fix file reference leak with IOSQE_FIXED_FILE\n\nNOP file-acquisition support choses between a fixed (registered) file and\na normal fget()'d file based on i…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= a85f31052bce52111b4e9d5a536003481d0421d0 < 722869fcff598fad20d5ab79c305897a7534708b","Linux >= a85f31052bce52111b4e9d5a536003481d0421d0 < 7267717f35787167fcce4bc14f6ef3fa06682dcf","Linux >= a85f31052bce52111b4e9d5a536003481d0421d0 < 2564ca2e31bd8ee8348362941af2ee4671e487ca","Linux 6.13"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:38:22.475440Z"},"published":"2026-07-25","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:44:51.451Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64426","references":[{"url":"https://git.kernel.org/stable/c/722869fcff598fad20d5ab79c305897a7534708b"},{"url":"https://git.kernel.org/stable/c/7267717f35787167fcce4bc14f6ef3fa06682dcf"},{"url":"https://git.kernel.org/stable/c/2564ca2e31bd8ee8348362941af2ee4671e487ca"}],"tags":["cve.org"],"epss":0.0016,"epssPercentile":0.052,"ingestedAt":"2026-11-06T16:57:43.185Z","slug":"CVE-2026-64426","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/nop: fix file reference leak with IOSQE_FIXED_FILE\n\nNOP file-acquisition support choses between a fixed (registered) file and\na normal fget()'d file based on its own IORING_NOP_FIXED_FILE flag in\nsqe->nop_flags. However, a request's REQ_F_FIXED_FILE is set\nindependently from the generic IOSQE_FIXED_FILE sqe flag during request\ninit, before the issue handler runs.\n\nIf a NOP is submitted with IOSQE_FIXED_FILE set (so REQ_F_FIXED_FILE is\nset) but without IORING_NOP_FIXED_FILE, io_nop() takes the normal path\nand grabs a real reference via io_file_get_normal(). On completion,\nio_put_file() only drops the reference when REQ_F_FIXED_FILE is clear,\nso the fget()'d file is never released and leaks:\n\n  BUG: memory leak\n  unreferenced object 0xffff88800f42c240 (size 176):\n    kmem_cache_alloc_noprof+0x358/0x440\n    alloc_empty_file+0x57/0x180\n    path_openat+0x44/0x1e50\n    do_file_open+0x121/0x200\n    do_sys_openat2+0xa7/0x150\n    __x64_sys_openat+0x82/0xf0\n\nDecide between fixed and normal file acquisition from REQ_F_FIXED_FILE,\nthe same way io_assign_file() does for every other opcode, and fold\nIORING_NOP_FIXED_FILE into REQ_F_FIXED_FILE at prep time.\n\n## Affected\n\n- `Linux >= a85f31052bce52111b4e9d5a536003481d0421d0 < 722869fcff598fad20d5ab79c305897a7534708b`\n- `Linux >= a85f31052bce52111b4e9d5a536003481d0421d0 < 7267717f35787167fcce4bc14f6ef3fa06682dcf`\n- `Linux >= a85f31052bce52111b4e9d5a536003481d0421d0 < 2564ca2e31bd8ee8348362941af2ee4671e487ca`\n- `Linux 6.13`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}