CVE-2026-80811: io_uring/cmd: fix iovec leak when the async cmd is not recycled

CVE-2026-80811: io_uring/cmd: fix iovec leak when the async cmd is not recycled

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

io_uring/cmd: fix iovec leak when the async cmd is not recycled

An io_async_cmd carries an iovec array in ->vec.iovec, allocated when the
vec has to grow and kept across recycling through ctx->cmd_cache.  On two
paths nothing frees it and io_clean_op()'s kfree(req->async_data) drops
the io_async_cmd without it.

io_req_uring_cleanup() clears the async data flags only when
io_alloc_cache_put() succeeds, and the cache holds IO_ALLOC_CACHE_MAX ==
128 entries, so once it is full the put fails and the vec is left behind.
An NVMe passthrough workload gets there without doing anything unusual:
nvme_uring_cmd_io() returns -EIOCBQUEUED, so the io_async_cmd stays
attached for the lifetime of the command and the live object count tracks
the queue depth.  Above 128 the puts start failing.

->cleanup is the last chance to free an inherited vec, since
io_req_uring_cleanup() returns early for an io-wq issued command and is
not called at all for one completed without ever being issued.  But
io_clean_op() calls ->cleanup only if REQ_F_NEED_CLEANUP is set, and for
uring_cmd that happens only where the vec has to grow, so a command
reusing a large enough cached vec never sets it.  io_rw_alloc_async() and
io_msg_alloc_async() flag an inherited vec for exactly this reason;
io_uring_cmd_prep() does not.

Flag an inherited vec in io_uring_cmd_prep(), and free the vec when the
cache put fails, as io_req_rw_cleanup() does.

The leak is invisible under KASAN, where io_alloc_cache_vec_kasan() frees
the vec unconditionally.

The Linux kernel CVE team has assigned CVE-2026-80811 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.15 with commit 3a4689ac109f18f23ea0d0c1c79e055142796858 and fixed in 6.18.47 with commit b6a768aa975b9ca81b92f028bdd975d1f8237894
	Issue introduced in 6.15 with commit 3a4689ac109f18f23ea0d0c1c79e055142796858 and fixed in 7.1.11 with commit b290de4d16d75b6c1ef42025b47f5d94eb1ec09f
	Issue introduced in 6.15 with commit 3a4689ac109f18f23ea0d0c1c79e055142796858 and fixed in 7.2.1 with commit 7068d3587a64a24943a7c9e232976da2c9e0e303
	Issue introduced in 6.15 with commit 3a4689ac109f18f23ea0d0c1c79e055142796858 and fixed in 7.3-rc1 with commit bb34ae5da3365699d53a756f4c96b6ea9f8ba0c1

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-80811
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	io_uring/uring_cmd.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b6a768aa975b9ca81b92f028bdd975d1f8237894
	https://git.kernel.org/stable/c/b290de4d16d75b6c1ef42025b47f5d94eb1ec09f
	https://git.kernel.org/stable/c/7068d3587a64a24943a7c9e232976da2c9e0e303
	https://git.kernel.org/stable/c/bb34ae5da3365699d53a756f4c96b6ea9f8ba0c1