CVE-2026-80811

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

io_uring/cmd: fix iovec leak when the async cmd is not recycled

An io_async_cmd carries an iovec array in ->vec.iovec, allocated when the

vec has to grow and kept across recycling through ctx->cmd_cache. On two

paths nothing frees it and io_clean_op()'s kfree(req->async_data) drops

the io_async_cmd without it.

io_req_uring_cleanup() clears the async data flags only when

io_alloc_cache_put() succeeds, and the cache holds IO_ALLOC_CACHE_MAX ==

128 entries, so once it is full the put fails and the vec is left behind.

An NVMe passthrough workload gets there without doing anything unusual:

nvme_uring_cmd_io() returns -EIOCBQUEUED, so the io_async_cmd stays

attached for the lifetime of the command and the live object count tracks

the queue depth. Above 128 the puts start failing.

->cleanup is the last chance to free an inherited vec, since

io_req_uring_cleanup() returns early for an io-wq issued command and is

not call

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References