PT-2026-26119 · Linux · Linux Kernel

Published 2026-01-01 · Updated 2026-05-29 · CVE-2026-23259

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the Linux kernel’s io uring/rw functionality where an allocated iovec may be freed incorrectly during a read/write request cleanup process. Specifically, if a read/write request proceeds through the io req rw cleanup() function with an allocated iovec and fails to be added to the rw cache, the iovec pointer may remain unaccounted for. The issue is addressed by modifying the io rw recycle() function to indicate whether the request was recycled, allowing for proper determination of whether to free the iovec. The vulnerable functions involved are io req rw cleanup() and io rw recycle().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BDU:2026-04163

CVE-2026-23259

SUSE-SU-2026:1573-1

SUSE-SU-2026:1661-1

Affected Products

Linux Kernel

References · 120

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23259.json · Exploit
• https://osv.dev/vulnerability/BELL-CVE-2026-23259 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-23259 · Security Note
• https://git.kernel.org/stable/c/1d5f2329ab4df65c2ee011b986d8a6e05ad0f67c · Patch
• https://git.kernel.org/stable/c/4b9748055457ac3a0710bf210c229d01ea1b01b9 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-23259 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23259 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23259 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04163 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23259 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2404-CVE-2026-23259 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1573-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23259 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2026-23259 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23259 · Vendor Advisory