CVE-2026-64426 Overview
CVE-2026-64426 is a file reference leak in the Linux kernel's io_uring subsystem, specifically in the NOP opcode handler. The flaw occurs when a NOP request is submitted with the generic IOSQE_FIXED_FILE sqe flag set but without the opcode-specific IORING_NOP_FIXED_FILE flag in sqe->nop_flags. The mismatch causes io_nop() to acquire a normal file reference via io_file_get_normal() while the completion path in io_put_file() skips releasing it because REQ_F_FIXED_FILE is set. Each mismatched submission leaks a struct file, gradually exhausting kernel memory on affected systems.
Critical Impact
Local users with access to io_uring can trigger unbounded kernel memory leaks by submitting crafted NOP operations, leading to resource exhaustion and potential denial of service.
Affected Products
- Linux kernel versions containing the NOP file-acquisition support in io_uring/nop.c prior to the fix
- Stable kernel branches receiving backports referenced by commits 2564ca2, 722869f, and 7267717
- Any distribution shipping vulnerable upstream kernels with io_uring enabled
Discovery Timeline
- 2026-07-25 - CVE CVE-2026-64426 published to NVD
- 2026-07-25 - Last updated in NVD database
Technical Details for CVE-2026-64426
Vulnerability Analysis
The Linux kernel's io_uring interface exposes an asynchronous I/O submission model where each submission queue entry (SQE) carries both generic flags and opcode-specific flags. The NOP opcode added optional file-acquisition support gated by its own IORING_NOP_FIXED_FILE flag in sqe->nop_flags. This local flag was consulted to decide whether to fetch a registered (fixed) file or call fget() for a normal file descriptor.
The generic request flag REQ_F_FIXED_FILE, however, is populated during request initialization from the SQE-level IOSQE_FIXED_FILE flag, before any opcode issue handler runs. The two flags can diverge. When IOSQE_FIXED_FILE is set but IORING_NOP_FIXED_FILE is not, io_nop() acquires a real file reference through io_file_get_normal(), yet io_put_file() at completion skips the fput() call because REQ_F_FIXED_FILE is asserted. The struct file allocated by the VFS layer is never released.
Root Cause
The root cause is inconsistent flag handling between request preparation and completion. Two independent flags controlled the same acquisition decision, allowing the issue path and the release path to disagree on which reference-management strategy applied. This is a memory leak vulnerability rooted in a logic error rather than a memory-safety bug.
Attack Vector
A local unprivileged user with permission to create an io_uring instance can repeatedly submit NOP entries with IOSQE_FIXED_FILE set and IORING_NOP_FIXED_FILE cleared. Each submission leaks one struct file from kmem_cache_alloc_noprof, along with any associated path and dentry references. Sustained submission drains kernel slab memory and file descriptor resources, degrading system stability and eventually causing denial of service.
The leak signature reported in the commit message shows allocations from alloc_empty_file, path_openat, do_file_open, and __x64_sys_openat remaining unreferenced after request completion.
Detection Methods for CVE-2026-64426
Indicators of Compromise
- Growing filp slab cache size observable via /proc/slabinfo without matching increases in open file descriptors
- Kernel memory leak reports from kmemleak referencing alloc_empty_file and path_openat call chains
- Sustained io_uring_enter syscall activity from unprivileged processes correlated with rising kernel memory usage
Detection Strategies
- Enable CONFIG_DEBUG_KMEMLEAK on test systems and monitor /sys/kernel/debug/kmemleak for unreferenced struct file allocations tied to io_uring workloads
- Audit process telemetry for high-frequency io_uring_setup and io_uring_enter calls originating from non-service accounts
- Track kernel slab usage trends and alert on abnormal growth in the filp and dentry caches independent of open FD counts
Monitoring Recommendations
- Collect kernel memory metrics via node_exporter or equivalent and baseline the filp slab cache per host
- Forward dmesg output containing BUG: memory leak or kmemleak warnings to a central SIEM for correlation
- Instrument eBPF probes on io_uring submission paths to attribute NOP opcode usage to specific processes
How to Mitigate CVE-2026-64426
Immediate Actions Required
- Apply the upstream fix from kernel commits 2564ca2e31bd, 722869fcff59, and 7267717f3578 or update to a distribution kernel that includes the backport
- Restrict io_uring availability to trusted workloads by setting kernel.io_uring_disabled=2 where the interface is not required
- Inventory hosts running kernels with io_uring enabled and prioritize patching multi-tenant systems
Patch Information
The fix folds IORING_NOP_FIXED_FILE into REQ_F_FIXED_FILE at preparation time, aligning NOP handling with io_assign_file() used by every other opcode. Reference the upstream commits Kernel Git Commit 2564ca2, Kernel Git Commit 722869f, and Kernel Git Commit 7267717 for the exact source changes.
Workarounds
- Disable io_uring system-wide via the kernel.io_uring_disabled sysctl on kernels that support it
- Use seccomp policies to block io_uring_setup and io_uring_enter syscalls for untrusted processes
- Constrain container runtimes to drop io_uring capability where feasible until the patched kernel is deployed
# Configuration example
# Disable io_uring for all users (requires kernel support)
echo 'kernel.io_uring_disabled = 2' | sudo tee /etc/sysctl.d/99-disable-io_uring.conf
sudo sysctl --system
# Verify the setting
sysctl kernel.io_uring_disabled
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
