Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: io_uring/cmd: fix iovec leak when the async cmd is not recycled An io_async_cmd… (CVE-2026-80811)

The vulnerability in the Linux kernel io_uring subsystem involves an iovec array allocated in io_async_cmd structures that is not freed on two specific code paths. When the command cache reaches its maximum capacity (128 entries), attempts to recycle commands fail, leaving the iovec array allocated and causing a memory leak. The cleanup function io_req_uring_cleanup() only clears async data flags when io_alloc_cache_put() succeeds, but when the cache is full, the put fails and the iovec array remains allocated. Additionally, the cleanup callback is only invoked if a specific flag (REQ_F_NEED_CLEANUP) is set, which does not occur for all commands, allowing the leak to persist. The fix involves flagging inherited iovec arrays properly and freeing them when cache recycling fails, similar to other async command types. This leak is invisible under KASAN due to unconditional freeing in that environment.

The vulnerability causes a memory leak in the Linux kernel io_uring subsystem, which could lead to increased memory consumption and potential resource exhaustion under workloads that heavily use NVMe passthrough commands or similar io_uring commands. There is no indication of direct code execution or privilege escalation from this leak. No known exploits are reported in the wild.

A fix has been implemented in the Linux kernel to properly flag and free the iovec arrays in io_async_cmd structures when recycling fails. Users should apply the official Linux kernel update that includes this fix once available. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory or Linux kernel mailing lists for the exact patch and update guidance.