---
id: CVE-2026-64426
title: 'io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE

  NOP file-acquisition support choses between a fixed (registered) file and
  a normal fget()'d file based on i…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a85f31052bce52111b4e9d5a536003481d0421d0 <
    722869fcff598fad20d5ab79c305897a7534708b
  - >-
    Linux >= a85f31052bce52111b4e9d5a536003481d0421d0 <
    7267717f35787167fcce4bc14f6ef3fa06682dcf
  - >-
    Linux >= a85f31052bce52111b4e9d5a536003481d0421d0 <
    2564ca2e31bd8ee8348362941af2ee4671e487ca
  - Linux 6.13
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:38:22.475440Z'
published: '2026-07-25'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:44:51.451Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64426'
references:
  - url: 'https://git.kernel.org/stable/c/722869fcff598fad20d5ab79c305897a7534708b'
  - url: 'https://git.kernel.org/stable/c/7267717f35787167fcce4bc14f6ef3fa06682dcf'
  - url: 'https://git.kernel.org/stable/c/2564ca2e31bd8ee8348362941af2ee4671e487ca'
tags:
  - cve.org
epss: 0.0016
epssPercentile: 0.052
ingestedAt: '2026-11-06T16:57:43.185Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE

NOP file-acquisition support choses between a fixed (registered) file and
a normal fget()'d file based on its own IORING_NOP_FIXED_FILE flag in
sqe->nop_flags. However, a request's REQ_F_FIXED_FILE is set
independently from the generic IOSQE_FIXED_FILE sqe flag during request
init, before the issue handler runs.

If a NOP is submitted with IOSQE_FIXED_FILE set (so REQ_F_FIXED_FILE is
set) but without IORING_NOP_FIXED_FILE, io_nop() takes the normal path
and grabs a real reference via io_file_get_normal(). On completion,
io_put_file() only drops the reference when REQ_F_FIXED_FILE is clear,
so the fget()'d file is never released and leaks:

  BUG: memory leak
  unreferenced object 0xffff88800f42c240 (size 176):
    kmem_cache_alloc_noprof+0x358/0x440
    alloc_empty_file+0x57/0x180
    path_openat+0x44/0x1e50
    do_file_open+0x121/0x200
    do_sys_openat2+0xa7/0x150
    __x64_sys_openat+0x82/0xf0

Decide between fixed and normal file acquisition from REQ_F_FIXED_FILE,
the same way io_assign_file() does for every other opcode, and fold
IORING_NOP_FIXED_FILE into REQ_F_FIXED_FILE at prep time.

## Affected

- `Linux >= a85f31052bce52111b4e9d5a536003481d0421d0 < 722869fcff598fad20d5ab79c305897a7534708b`
- `Linux >= a85f31052bce52111b4e9d5a536003481d0421d0 < 7267717f35787167fcce4bc14f6ef3fa06682dcf`
- `Linux >= a85f31052bce52111b4e9d5a536003481d0421d0 < 2564ca2e31bd8ee8348362941af2ee4671e487ca`
- `Linux 6.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.