diff --git a/fs/io_uring.c b/fs/io_uring.c
index 06dc99420f875f6ec626cc034bf29a57e861ead2..cde4ef4c7638b30171ce420c4b23e9637fa03b9a 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -2511,6 +2511,8 @@ static int io_openat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 
 	if (sqe->ioprio || sqe->buf_index)
 		return -EINVAL;
+	if (sqe->flags & IOSQE_FIXED_FILE)
+		return -EBADF;
 
 	req->open.dfd = READ_ONCE(sqe->fd);
 	req->open.mode = READ_ONCE(sqe->len);
@@ -2688,6 +2690,8 @@ static int io_statx_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 
 	if (sqe->ioprio || sqe->buf_index)
 		return -EINVAL;
+	if (sqe->flags & IOSQE_FIXED_FILE)
+		return -EBADF;
 
 	req->open.dfd = READ_ONCE(sqe->fd);
 	req->open.mask = READ_ONCE(sqe->len);
@@ -2761,7 +2765,7 @@ static int io_close_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 	    sqe->rw_flags || sqe->buf_index)
 		return -EINVAL;
 	if (sqe->flags & IOSQE_FIXED_FILE)
-		return -EINVAL;
+		return -EBADF;
 
 	req->close.fd = READ_ONCE(sqe->fd);
 	if (req->file->f_op == &io_uring_fops ||