{ "cveId": "CVE-2026-80811", "url": "https://patchblox.com/security/cve/CVE-2026-80811", "summary": "CVE-2026-80811 is fixed in 20 products on 1 platform, first by DEBIAN-CVE-2026-80811, released September 5, 2026. It is not reported as exploited. Patch Radar priority: High.", "title": "linux: In the Linux kernel, the following vulnerability has been resolved: io_uring/cmd: fix iovec leak when the async cmd...", "description": "In the Linux kernel, the following vulnerability has been resolved: io_uring/cmd: fix iovec leak when the async cmd is not recycled An io_async_cmd carries an iovec array in -\u003Evec.iovec, allocated when the vec has to grow and kept across recycling through ctx-\u003Ecmd_cache. On two paths nothing frees it and io_clean_op()\u0027s kfree(req-\u003Easync_data) drops the io_async_cmd without it. io_req_uring_cleanup() clears the async data flags only when io_alloc_cache_put() succeeds, and the cache holds IO_ALLOC_CACHE_MAX == 128 entries, so once it is full the put fails and the vec is left behind. An NVMe passthrough workload gets there without doing anything unusual: nvme_uring_cmd_io() returns -EIOCBQUEUED, so the io_async_cmd stays attached for the lifetime of the command and the live object count tracks the queue depth. Above 128 the puts start failing. -\u003Ecleanup is the last chance to free an inherited vec, since io_req_uring_cleanup() returns early for an io-wq issued command and is not called at all for one completed without ever being issued. But io_clean_op() calls -\u003Ecleanup only if REQ_F_NEED_CLEANUP is set, and for uring_cmd that happens only where the vec has to grow, so a command reusing a large enough cached vec never sets it. io_rw_alloc_async() and io_msg_alloc_async() flag an inherited vec for exactly this reason; io_uring_cmd_prep() does not. Flag an inherited vec in io_uring_cmd_prep(), and free the vec when the cache put fails, as io_req_rw_cleanup() does. The leak is invisible under KASAN, where io_alloc_cache_vec_kasan() frees the vec unconditionally.", "published": "2026-09-04T16:18:08Z", "severity": "important", "priority": "High", "priorityTier": 3, "exploited": false, "vendorExploited": false, "disclosed": false, "fixes": [ { "platform": "linux", "product": "bpftool6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.48-107.148.amzn2023", "fix": "ALAS2023-2026-3139", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139", "released": "2026-09-28T09:00:00Z" }, { "platform": "linux", "product": "bpftool6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.48-107.148.amzn2023", "fix": "ALAS2023-2026-3139", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139", "released": "2026-09-28T09:00:00Z" }, { "platform": "linux", "product": "kernel-livepatch-6.18.48-107.148", "release": "amzn 2023", "fixedVersion": "1:1.0-0.amzn2023", "fix": "ALAS2023-2026-3139", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139", "released": "2026-09-28T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.48-107.148.amzn2023", "fix": "ALAS2023-2026-3139", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139", "released": "2026-09-28T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.48-107.148.amzn2023", "fix": "ALAS2023-2026-3139", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139", "released": "2026-09-28T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo-common-aarch64", "release": "amzn 2023", "fixedVersion": "1:6.18.48-107.148.amzn2023", "fix": "ALAS2023-2026-3139", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139", "released": "2026-09-28T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo-common-x86_64", "release": "amzn 2023", "fixedVersion": "1:6.18.48-107.148.amzn2023", "fix": "ALAS2023-2026-3139", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139", "released": "2026-09-28T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-devel", "release": "amzn 2023", "fixedVersion": "1:6.18.48-107.148.amzn2023", "fix": "ALAS2023-2026-3139", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139", "released": "2026-09-28T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-headers", "release": "amzn 2023", "fixedVersion": "1:6.18.48-107.148.amzn2023", "fix": "ALAS2023-2026-3139", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139", "released": "2026-09-28T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-modules-extra", "release": "amzn 2023", "fixedVersion": "1:6.18.48-107.148.amzn2023", "fix": "ALAS2023-2026-3139", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139", "released": "2026-09-28T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-modules-extra-common", "release": "amzn 2023", "fixedVersion": "1:6.18.48-107.148.amzn2023", "fix": "ALAS2023-2026-3139", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139", "released": "2026-09-28T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-tools", "release": "amzn 2023", "fixedVersion": "1:6.18.48-107.148.amzn2023", "fix": "ALAS2023-2026-3139", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139", "released": "2026-09-28T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-tools-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.48-107.148.amzn2023", "fix": "ALAS2023-2026-3139", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139", "released": "2026-09-28T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-tools-devel", "release": "amzn 2023", "fixedVersion": "1:6.18.48-107.148.amzn2023", "fix": "ALAS2023-2026-3139", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139", "released": "2026-09-28T09:00:00Z" }, { "platform": "linux", "product": "linux", "release": "Debian 14", "fixedVersion": "7.1.12-1", "fix": "DEBIAN-CVE-2026-80811", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-80811", "released": "2026-09-05T01:57:10Z" }, { "platform": "linux", "product": "microvm-kernel6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.48-107.148.amzn2023", "fix": "ALAS2023-2026-3139", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139", "released": "2026-09-28T09:00:00Z" }, { "platform": "linux", "product": "perf6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.48-107.148.amzn2023", "fix": "ALAS2023-2026-3139", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139", "released": "2026-09-28T09:00:00Z" }, { "platform": "linux", "product": "perf6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.48-107.148.amzn2023", "fix": "ALAS2023-2026-3139", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139", "released": "2026-09-28T09:00:00Z" }, { "platform": "linux", "product": "python3-perf6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.48-107.148.amzn2023", "fix": "ALAS2023-2026-3139", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139", "released": "2026-09-28T09:00:00Z" }, { "platform": "linux", "product": "python3-perf6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.48-107.148.amzn2023", "fix": "ALAS2023-2026-3139", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139", "released": "2026-09-28T09:00:00Z" } ], "noFixYet": [], "dataAsOf": "2026-11-08T19:12:23Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }