---
cve: "CVE-2026-64426"
severity: "LOW"
cvss: 3.1
epss: "17%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-07-25 10:17:26"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-06T17:02:26+02:00"
---

# CVE-2026-64426

> 3.1 LOW

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE

NOP file-acquisition support choses between a fixed (registered) file and
a normal fget()'d file based on its own IORING_NOP_FIXED_FILE flag in
sqe->nop_flags. However, a request's REQ_F_FIXED_FILE is set
independently from the generic IOSQE_FIXED_FILE sqe flag during request
init, before the issue handler runs.

If a NOP is submitted with IOSQE_FIXED_FILE set (so REQ_F_FIXED_FILE is
set) but without IORING_NOP_FIXED_FILE, io_nop() takes the normal path
and grabs a real reference via io_file_get_normal(). On completion,
io_put_file() only drops the reference when REQ_F_FIXED_FILE is clear,
so the fget()'d file is never released and leaks:

  BUG: memory leak
  unreferenced object 0xffff88800f42c240 (size 176):
    kmem_cache_alloc_noprof+0x358/0x440
    alloc_empty_file+0x57/0x180
    path_openat+0x44/0x1e50
    do_file_open+0x121/0x200
    do_sys_openat2+0xa7/0x150
    __x64_sys_openat+0x82/0xf0

Decide between fixed and normal file acquisition from REQ_F_FIXED_FILE,
the same way io_assign_file() does for every other opcode, and fold
IORING_NOP_FIXED_FILE into REQ_F_FIXED_FILE at prep time.

## Patch verfügbar (OSV)

- Kernel ≥ 6.18.39
- Kernel ≥ 7.1.4

## Referenzen

- <https://git.kernel.org/stable/c/722869fcff598fad20d5ab79c305897a7534708b>
- <https://git.kernel.org/stable/c/7267717f35787167fcce4bc14f6ef3fa06682dcf>
- <https://git.kernel.org/stable/c/2564ca2e31bd8ee8348362941af2ee4671e487ca>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-64426) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_