In the Linux kernel the io_uring subsystem has a bug where a read or write request that fails to store its I/O vector (iovec) in the rw_cache is not reclaimed. Each failure leaves an unreferenced iovec allocation, causing a memory leak in kernel space. If an attacker or malfunctioning application repeatedly triggers these failures, the kernel’s memory consumption can grow without bound, potentially exhausting available memory and making the system unstable or unresponsive.

All versions of the Linux kernel that include the io_uring rw_cache code before the commit that implements the fix are affected. This includes, but is not limited to, the 6.19 release series (rc1 through rc6) and any earlier kernel releases. Systems running any kernel lacking the patch are vulnerable.

The CVSS score of 5.5 indicates moderate severity. The EPSS score is below 1 %, suggesting that exploitation is unlikely and no known attacks have been reported; the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker with local privileges could trigger many failing io_uring requests, and no remote exploit path is described. If successfully triggered, the leak can lead to memory exhaustion and a denial of service.