In the Linux kernel, the io_uring NOP opcode contained a bug where the choice between a fixed (registered) file and a normal file acquired via fget() was incorrectly determined. When a NOP was submitted with the IOSQE_FIXED_FILE flag but without the IORING_NOP_FIXED_FILE flag, the kernel used the normal path and grabbed a new file reference. Because the reference flag was never cleared, that reference was never released, leaving an unreferenced kernel memory object that remains allocated. The leak occurs each time such a NOP is executed, potentially accumulating and exhausting memory.

This issue affects all Linux kernel releases that do not yet include the patch that folds IORING_NOP_FIXED_FILE into REQ_F_FIXED_FILE during request preparation. Every distribution shipping an affected kernel carries the flaw until the fix is applied. The CVE listing does not specify exact kernel versions, so all current kernels lacking the patch are considered vulnerable.

The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of exploitation in the wild. With a CVSS score of 5.5, the vulnerability is considered medium severity. The flaw does not provide code execution or privilege escalation; rather, it permits a local process that can submit io_uring NOP requests to leak kernel memory. Repeated exploitation could consume memory and potentially trigger a denial-of-service condition. The attack vector is local and requires the ability to create io_uring submissions with the incorrect flag combination. Because the kernel itself performs the faulty decision, any unpatched kernel will leak memory whenever such malformed NOP requests are processed.