CVE-2026-80811

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory leak occurs in the io uring/cmd component when an io async cmd is not recycled. The io async cmd contains an iovec array in ->vec.iovec that is allocated when the vector needs to grow. A leak happens because io req uring cleanup() only clears async data flags if io alloc cache put() succeeds; however, once the cache reaches its limit of 128 entries, the put operation fails and the iovec is not freed. This is particularly observable in NVMe passthrough workloads where nvme uring cmd io() returns -EIOCBQUEUED, causing the io async cmd to remain attached. Additionally, io clean op() only calls the cleanup function if REQ F NEED CLEANUP is set, but io uring cmd prep() fails to set this flag for inherited vectors. The issue involves the io uring cmd prep() function and the io alloc cache put() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.