Ubuntu fixes Linux kernel io_uring flaws enabling local denial of service
Original title: USN-9020-1: Linux kernel vulnerabilities
CVE-2026-80811 can exhaust memory and CVE-2026-81009 can hang the system; a third issue is only partly described.
Ubuntu notice USN-9020-1 covers Linux kernel io_uring flaws. A local attacker could trigger a memory leak during certain asynchronous commands or cause a system hang through an improperly sized query. A further flaw involving canceled task work during wait operations is cut off in the text. No exploitation or fixed versions are stated.
Unconfirmed: The third flaw is truncated, and no CVE for it or fixed versions are stated.
- CVE-2026-80811 is an io_uring memory leak on certain asynchronous commands.
- CVE-2026-81009 is missing size checks on certain query requests.
- The truncated issue involves canceled task work running in the wrong context.
- The notice gives no fixed package versions.
Impact: local denial of service by memory exhaustion or system hang
| Product | Affected |
|---|---|
| Ubuntu Linux kernel | — |
- 1.Install the kernel updates referenced in Ubuntu notice USN-9020-1.
- Vendors
- Ubuntu
- Products
- Linux kernel
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-80811 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority | — | <1% | ||
| CVE-2026-81009 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority | — | — |
From the original article
It was discovered that the io_uring subsystem in the Linux kernel contained a memory leak when handling certain asynchronous commands. A local attacker could possibly use this to cause a denial of service (memory exhaustion). (CVE-2026-80811) It was discovered that the io_uring subsystem in the Linux kernel did not properly validate the size of certain query requests.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.