This vulnerability arises when a read or write request processed by io_uring's cleanup routine fails to be stored in the rw_cache yet an I/O vector (ovec) has been allocated. Because the cleanup path does not free the leftover iovec, each failure results in a retained memory allocation. Over time, repeated failures can cause unreclaimed kernel memory usage to grow, degrading system stability. The root weakness is a memory leak, which can lead to resource exhaustion.

Affected systems are Linux kernel implementations that use the io_uring subsystem, specifically the rw_cache component. The issue appears in all kernel releases prior to the inclusion of the commit that resolves the problem; a specific version range is not provided. Systems running a kernel without the fix are susceptible.

The CVSS score of 5.5 indicates moderate severity. EPSS indicates that the likelihood of exploitation is very low (<1 %) and the vulnerability is not listed in the CISA KEV catalog. A local attacker who can generate numerous io_uring read/write operations that fail to cache could exploit the bug, causing memory exhaustion and potential denial of service. The attack vector is inferred to be local and related to kernel I/O handling; no remote exploitation pathway is described.