---
id: CVE-2026-23259
title: 'io_uring/rw: free potentially allocated iovec on cache put failure'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  io_uring/rw: free potentially allocated iovec on cache put failure

  If a read/write request goes through io_req_rw_cleanup() and has an
  allocated iovec attached and fai…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a9165b83c1937eeed1f0c731468216d6371d647f <
    41cda4c66846c3bfcdeaf28444ccabbb55e64cf1
  - >-
    Linux >= a9165b83c1937eeed1f0c731468216d6371d647f <
    1d5f2329ab4df65c2ee011b986d8a6e05ad0f67c
  - >-
    Linux >= a9165b83c1937eeed1f0c731468216d6371d647f <
    4b9748055457ac3a0710bf210c229d01ea1b01b9
  - Linux 6.10
published: '2026-03-18'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:39:03.826Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23259'
references:
  - url: 'https://git.kernel.org/stable/c/41cda4c66846c3bfcdeaf28444ccabbb55e64cf1'
  - url: 'https://git.kernel.org/stable/c/1d5f2329ab4df65c2ee011b986d8a6e05ad0f67c'
  - url: 'https://git.kernel.org/stable/c/4b9748055457ac3a0710bf210c229d01ea1b01b9'
tags:
  - cve.org
epss: 0.00104
epssPercentile: 0.00965
ingestedAt: '2026-10-21T12:48:53.669Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

io_uring/rw: free potentially allocated iovec on cache put failure

If a read/write request goes through io_req_rw_cleanup() and has an
allocated iovec attached and fails to put to the rw_cache, then it may
end up with an unaccounted iovec pointer. Have io_rw_recycle() return
whether it recycled the request or not, and use that to gauge whether to
free a potential iovec or not.

## Affected

- `Linux >= a9165b83c1937eeed1f0c731468216d6371d647f < 41cda4c66846c3bfcdeaf28444ccabbb55e64cf1`
- `Linux >= a9165b83c1937eeed1f0c731468216d6371d647f < 1d5f2329ab4df65c2ee011b986d8a6e05ad0f67c`
- `Linux >= a9165b83c1937eeed1f0c731468216d6371d647f < 4b9748055457ac3a0710bf210c229d01ea1b01b9`
- `Linux 6.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.