CVE-2026-64426None▾ Sunlit

io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE

In the Linux kernel, the following vulnerability has been resolved: io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE NOP file-acquisition support choses between a fixed (registered) file and a normal fget()'d file based on i…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jul 25, 2026

Updated

Nov 6, 2026

CVSS

—

Vendor

Linux

Product

Linux

CWE

—

Depth score

3 · Minimal

EPSS

0.16% · p5

Platforms

—

Source

CVEORG

Vector

—

CISA SSVC

decided 2026-11-06

Exploitation: none
Automatable: no
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Nov 6.

0.2% → 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 104 days

Jul 25, 2026Published
Disclosed via CVEORG
Nov 6, 2026Record revised
Last analysed / modified upstream
Nov 6, 2026EPSS first tracked
0.2%

Linux #cve.org

Affected

Linux >= a85f31052bce52111b4e9d5a536003481d0421d0 < 722869fcff598fad20d5ab79c305897a7534708b
Linux >= a85f31052bce52111b4e9d5a536003481d0421d0 < 7267717f35787167fcce4bc14f6ef3fa06682dcf
Linux >= a85f31052bce52111b4e9d5a536003481d0421d0 < 2564ca2e31bd8ee8348362941af2ee4671e487ca
Linux 6.13

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE

NOP file-acquisition support choses between a fixed (registered) file and a normal fget()'d file based on its own IORING_NOP_FIXED_FILE flag in sqe->nop_flags. However, a request's REQ_F_FIXED_FILE is set independently from the generic IOSQE_FIXED_FILE sqe flag during request init, before the issue handler runs.

If a NOP is submitted with IOSQE_FIXED_FILE set (so REQ_F_FIXED_FILE is set) but without IORING_NOP_FIXED_FILE, io_nop() takes the normal path and grabs a real reference via io_file_get_normal(). On completion, io_put_file() only drops the reference when REQ_F_FIXED_FILE is clear, so the fget()'d file is never released and leaks:

BUG: memory leak unreferenced object 0xffff88800f42c240 (size 176): kmem_cache_alloc_noprof+0x358/0x440 alloc_empty_file+0x57/0x180 path_openat+0x44/0x1e50 do_file_open+0x121/0x200 do_sys_openat2+0xa7/0x150 __x64_sys_openat+0x82/0xf0

Decide between fixed and normal file acquisition from REQ_F_FIXED_FILE, the same way io_assign_file() does for every other opcode, and fold IORING_NOP_FIXED_FILE into REQ_F_FIXED_FILE at prep time.

Affected

Linux >= a85f31052bce52111b4e9d5a536003481d0421d0 < 722869fcff598fad20d5ab79c305897a7534708b
Linux >= a85f31052bce52111b4e9d5a536003481d0421d0 < 7267717f35787167fcce4bc14f6ef3fa06682dcf
Linux >= a85f31052bce52111b4e9d5a536003481d0421d0 < 2564ca2e31bd8ee8348362941af2ee4671e487ca
Linux 6.13

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org

io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0 · exploitation 0

Overview

In the Linux kernel, the following vulnerability has been resolved:

io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE

Decide between fixed and normal file acquisition from REQ_F_FIXED_FILE, the same way io_assign_file() does for every other opcode, and fold IORING_NOP_FIXED_FILE into REQ_F_FIXED_FILE at prep time.