From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5203D4A1E03 for ; Fri, 4 Sep 2026 15:18:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788535121; cv=none; b=h5Iq/Aukpw2iFAofmMddchYrn3+EZYDB9jj7SMWIZ6jmskflfxwyZZKyc5ZUl9Hq+93Wj6eLqgUybkIbi1FZFzS1HrY+f+UrmlHGqcrXSZiN4X8ke43N8A9peKOGFUG57pxoWA6169FL6bAfi45sd+PorWnFdpmOvBGRWJLWFZg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788535121; c=relaxed/simple; bh=YVa1YjWng+1PbqonshfwgEK5ECJ6w3gpOYnoCkY+07w=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=fEuaQk8KqPTRmEZrZb4KnhKt5H0hKqihWtjJqDz086GPTWfnVUCelqSBq4kjEhRo71VR7hfVlYKi1EjHUkIKeAPLUFrl7/jfPQJIWn15h+TNmFBvFs/UHiIjl+pk35vTa3DP236WP3QLUrVkB7kiMUYPx5JrR/NTHoEpAUd0ozE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=rqMtE98a; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="rqMtE98a" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 58A1D1F00A3D; Fri, 4 Sep 2026 15:18:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1788535120; bh=Q/orvQZ1mdrSkIIPZRHlv7qHlNBJr2BB6fnhDHX2iqk=; h=From:To:Cc:Subject:Date:Reply-To; b=rqMtE98aPiQ0sFyX/5/QkaN741BX+my4fLZ/0ogiCWekenPYhJhSZHKJaBmaHC9Cy XLGZ8bNHbWqUk8KeudZ4zL0wM4Ps8B4VQA3nD4icIBc+yR5snHirIDnLGwQKZp6hlZ QBj5LmhSwPZ1iFhMLEN3GOpb4n9Q87fK7A2GYTAU= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-80811: io_uring/cmd: fix iovec leak when the async cmd is not recycled Date: Fri, 4 Sep 2026 17:11:50 +0200 Message-ID: <2026090411-CVE-2026-80811-cf0f@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3709; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=v+GW4hhCAt7xS4mcpRMANp2buKyDrPLqpq4dmnVBjiI=; b=owGbwMvMwCRo6H6F97bub03G02pJDFmz7vf/esp2oifijnyoec43M+WTdvyTI1Nv/HJ05vecM GPe/+mzOmJZGASZGGTFFFm+bOM5ur/ikKKXoe1pmDmsTCBDGLg4BWAip44xLLh5ae6ujRFZm68W 5u3r4NXiEWvQT2JYcMHdYsbW5Zm2k5KCbyR8SFZaatP6DAA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: io_uring/cmd: fix iovec leak when the async cmd is not recycled An io_async_cmd carries an iovec array in ->vec.iovec, allocated when the vec has to grow and kept across recycling through ctx->cmd_cache. On two paths nothing frees it and io_clean_op()'s kfree(req->async_data) drops the io_async_cmd without it. io_req_uring_cleanup() clears the async data flags only when io_alloc_cache_put() succeeds, and the cache holds IO_ALLOC_CACHE_MAX == 128 entries, so once it is full the put fails and the vec is left behind. An NVMe passthrough workload gets there without doing anything unusual: nvme_uring_cmd_io() returns -EIOCBQUEUED, so the io_async_cmd stays attached for the lifetime of the command and the live object count tracks the queue depth. Above 128 the puts start failing. ->cleanup is the last chance to free an inherited vec, since io_req_uring_cleanup() returns early for an io-wq issued command and is not called at all for one completed without ever being issued. But io_clean_op() calls ->cleanup only if REQ_F_NEED_CLEANUP is set, and for uring_cmd that happens only where the vec has to grow, so a command reusing a large enough cached vec never sets it. io_rw_alloc_async() and io_msg_alloc_async() flag an inherited vec for exactly this reason; io_uring_cmd_prep() does not. Flag an inherited vec in io_uring_cmd_prep(), and free the vec when the cache put fails, as io_req_rw_cleanup() does. The leak is invisible under KASAN, where io_alloc_cache_vec_kasan() frees the vec unconditionally. The Linux kernel CVE team has assigned CVE-2026-80811 to this issue. Affected and fixed versions =========================== Issue introduced in 6.15 with commit 3a4689ac109f18f23ea0d0c1c79e055142796858 and fixed in 6.18.47 with commit b6a768aa975b9ca81b92f028bdd975d1f8237894 Issue introduced in 6.15 with commit 3a4689ac109f18f23ea0d0c1c79e055142796858 and fixed in 7.1.11 with commit b290de4d16d75b6c1ef42025b47f5d94eb1ec09f Issue introduced in 6.15 with commit 3a4689ac109f18f23ea0d0c1c79e055142796858 and fixed in 7.2.1 with commit 7068d3587a64a24943a7c9e232976da2c9e0e303 Issue introduced in 6.15 with commit 3a4689ac109f18f23ea0d0c1c79e055142796858 and fixed in 7.3-rc1 with commit bb34ae5da3365699d53a756f4c96b6ea9f8ba0c1 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-80811 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: io_uring/uring_cmd.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/b6a768aa975b9ca81b92f028bdd975d1f8237894 https://git.kernel.org/stable/c/b290de4d16d75b6c1ef42025b47f5d94eb1ec09f https://git.kernel.org/stable/c/7068d3587a64a24943a7c9e232976da2c9e0e303 https://git.kernel.org/stable/c/bb34ae5da3365699d53a756f4c96b6ea9f8ba0c1