CVE-2026-23259: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23259 is a memory leak vulnerability in the Linux kernel's io_uring/rw subsystem, specifically in the handling of iovec pointers during read/write request cleanup. When a request passes through io_req_rw_cleanup() with an allocated iovec and fails to return it to the rw_cache, the iovec pointer becomes unaccounted and is never freed. The vulnerability affects Linux kernel versions 6.10 through 6.18.9 (fixed in 6.18.10) and 6.19 release candidates (fixed in 6.19). It carries a CVSS v3.1 base score of 5.5 (Medium), with local access and low privileges required (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a memory management flaw (CWE-401: Missing Release of Memory after Effective Lifetime) in the io_rw_recycle() function within the Linux kernel's io_uring/rw subsystem. When a read/write request is cleaned up via io_req_rw_cleanup() and the attempt to return the request to the rw_cache fails, any iovec buffer that was dynamically allocated for that request is not freed — resulting in a memory leak. The fix modifies io_rw_recycle() to return a boolean indicating whether the request was successfully recycled, and uses that return value to conditionally free the iovec pointer. Exploitation requires local access with low privileges and no user interaction (Red Hat Bugzilla, Kernel Patch 1, Kernel Patch 2).

Successful exploitation allows a local, low-privileged attacker to cause a gradual memory leak by repeatedly triggering io_uring read/write requests that fail to recycle their iovec buffers. Over time, this exhausts available kernel memory, leading to denial of service through system performance degradation, instability, or crashes. There is no confidentiality or integrity impact; the vulnerability is limited to availability (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Detection coverage is available via Qualys (detection ID 362056) (Red Hat Advisory).

Apply the upstream kernel patches fixing this issue: upgrade to Linux kernel 6.18.10 or 6.19 (stable). The specific fixes are available at git commits 1d5f2329ab4df65c2ee011b986d8a6e05ad0f67c and 4b9748055457ac3a0710bf210c229d01ea1b01b9. SUSE has released a security update (SUSE-SU-2026:1661-1) addressing this vulnerability. As a compensating control, restrict local user access and limit io_uring usage to trusted processes. Monitor system memory usage for unexpected growth patterns (Kernel Patch 1, Kernel Patch 2, SUSE Advisory).