The Linux kernel’s io_uring subsystem has a flaw that can cause an iovec array to remain allocated when asynchronous commands are not properly recycled. The bug allows an allocation to survive beyond its intended life cycle, leaking kernel memory. If exploited repeatedly, the accumulation of these leaks can consume significant kernel memory, potentially degrading system performance or causing a denial‑of‑service condition.

All Linux kernel builds that include io_uring support are affected, regardless of vendor or distribution. The vulnerability exists in the kernel’s io_async_cmd handling and therefore applies to any host running a kernel where the io_uring code has not been patched. No specific kernel release numbers are provided, so any active system with io_uring enabled is potentially vulnerable.

The issue is not currently listed in the CISA KEV catalogue and no EPSS score is available, indicating no public evidence of exploitation. In a typical scenario, a privileged or inter‑process user can submit many io_uring commands—particularly NVMe passthrough operations—to trigger the leak whenever the queue depth exceeds 128 entries. Because the leak occurs in kernel address space, it does not provide direct code execution but can exhaust memory resources, leading to degraded availability. The severity is therefore moderate, with the main risk being resource exhaustion rather than direct privilege escalation or data disclosure.