CVE-2026-80720 (GCVE-0-2026-80720)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:53 – Updated: 2026-08-29 06:22
VLAI
Title
iomap: add a separate bio_set for iomap_split_ioend
Summary
In the Linux kernel, the following vulnerability has been resolved: iomap: add a separate bio_set for iomap_split_ioend iomap_split_ioend can split bios that already come from iomap_ioend_bioset and thus deadlock when the bioset is exhausted. Add a separate bio_set to avoid this deadlock. Christian Brauner <brauner@kernel.org> says: Mark iomap_ioend_split_bioset static as it is only used in ioend.c, fixing the sparse warning reported by the kernel test robot.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5fcbd555d48390a8c819ba7fdf55fbfcabe05c80 , < cfc686a1174aa904dcad9b9a7c5e46b484d27e4e (git)
Affected: 5fcbd555d48390a8c819ba7fdf55fbfcabe05c80 , < 4a869be56e9f6ce7462abcf324ebdefc5de051be (git)
Affected: 5fcbd555d48390a8c819ba7fdf55fbfcabe05c80 , < c679ce3be6cb63763d68ab9b5d9d73ddc0a40762 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.15
Unaffected: 0 , < 6.15 (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/iomap/ioend.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cfc686a1174aa904dcad9b9a7c5e46b484d27e4e",
              "status": "affected",
              "version": "5fcbd555d48390a8c819ba7fdf55fbfcabe05c80",
              "versionType": "git"
            },
            {
              "lessThan": "4a869be56e9f6ce7462abcf324ebdefc5de051be",
              "status": "affected",
              "version": "5fcbd555d48390a8c819ba7fdf55fbfcabe05c80",
              "versionType": "git"
            },
            {
              "lessThan": "c679ce3be6cb63763d68ab9b5d9d73ddc0a40762",
              "status": "affected",
              "version": "5fcbd555d48390a8c819ba7fdf55fbfcabe05c80",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/iomap/ioend.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niomap: add a separate bio_set for iomap_split_ioend\n\niomap_split_ioend can split bios that already come from\niomap_ioend_bioset and thus deadlock when the bioset is exhausted.\n\nAdd a separate bio_set to avoid this deadlock.\n\nChristian Brauner \u003cbrauner@kernel.org\u003e says:\nMark iomap_ioend_split_bioset static as it is only used in ioend.c,\nfixing the sparse warning reported by the kernel test robot."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - On ZNS-backed XFS realtime volumes exported via nfsd/ksmbd, remote client write I/O reaches vfs_write()-\u003exfs_zone_alloc_and_submit()-\u003eiomap_split_ioend() in the server kernel without local shell access.\nAC:L - An attacker with write access can deterministically exhaust the 32-entry iomap_ioend_bioset via concurrent large zoned writes or direct I/O needing multiple bio_split allocations from the same pool; they control thread count and I/O size without uncontrollable races.\nPR:N - Triggering requires only permission to write realtime files on an XFS zoned filesystem via local syscall or network NFS/SMB client write; no CAP_SYS_ADMIN, ioctl, or init-namespace root is needed beyond write access to exported storage.\nUI:N - The attacker triggers the deadlock with their own concurrent write or direct-I/O requests; no separate victim must mount media, open a file, or perform any interactive action beyond the attacker\u0027s own I/O.\nS:U - The bioset mempool deadlock freezes zoned XFS I/O within the same host kernel security authority; it does not cross a VM, IOMMU, or sandbox boundary.\nC:N - This is a mempool self-deadlock with no memory corruption, out-of-bounds access, use-after-free, or information disclosure; bio_split failure returns -ENOMEM rather than leaking kernel data.\nI:N - The bug causes tasks to block indefinitely on mempool allocation but does not corrupt, modify, or overwrite file data or enable arbitrary writes or code execution.\nA:H - When iomap_ioend_bioset is exhausted, bio_split blocks on mempool_alloc() while holders cannot release entries, deadlocking writeback workers and zoned submit paths and hanging all I/O on the affected XFS zoned filesystem."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T06:22:35.780Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cfc686a1174aa904dcad9b9a7c5e46b484d27e4e"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a869be56e9f6ce7462abcf324ebdefc5de051be"
        },
        {
          "url": "https://git.kernel.org/stable/c/c679ce3be6cb63763d68ab9b5d9d73ddc0a40762"
        }
      ],
      "title": "iomap: add a separate bio_set for iomap_split_ioend",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80720",
    "datePublished": "2026-08-28T06:53:16.683Z",
    "dateReserved": "2026-08-26T14:34:25.788Z",
    "dateUpdated": "2026-08-29T06:22:35.780Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80720",
      "date": "2026-09-21",
      "epss": "0.00339",
      "percentile": "0.27346"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/iomap/ioend.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "cfc686a1174aa904dcad9b9a7c5e46b484d27e4e",
                    "status": "affected",
                    "version": "5fcbd555d48390a8c819ba7fdf55fbfcabe05c80",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4a869be56e9f6ce7462abcf324ebdefc5de051be",
                    "status": "affected",
                    "version": "5fcbd555d48390a8c819ba7fdf55fbfcabe05c80",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c679ce3be6cb63763d68ab9b5d9d73ddc0a40762",
                    "status": "affected",
                    "version": "5fcbd555d48390a8c819ba7fdf55fbfcabe05c80",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/iomap/ioend.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.15"
                  },
                  {
                    "lessThan": "6.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.44",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niomap: add a separate bio_set for iomap_split_ioend\n\niomap_split_ioend can split bios that already come from\niomap_ioend_bioset and thus deadlock when the bioset is exhausted.\n\nAdd a separate bio_set to avoid this deadlock.\n\nChristian Brauner \u003cbrauner@kernel.org\u003e says:\nMark iomap_ioend_split_bioset static as it is only used in ioend.c,\nfixing the sparse warning reported by the kernel test robot."
          }
        ],
        "id": "CVE-2026-80720",
        "lastModified": "2026-08-29T07:16:53.473",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-28T08:16:57.810",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4a869be56e9f6ce7462abcf324ebdefc5de051be"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c679ce3be6cb63763d68ab9b5d9d73ddc0a40762"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cfc686a1174aa904dcad9b9a7c5e46b484d27e4e"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T14:13:17+00:00",
      "cve": "CVE-2026-80720",
      "id": "CVE-2026-80720",
      "initial_release_date": "2026-08-28T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iomap: add a separate bio_set for iomap_split_ioend",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80720.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:09:28Z",
      "cve": "CVE-2026-80720",
      "id": "CVE-2026-80720",
      "initial_release_date": "2026-08-28T16:33:06Z",
      "product_status:known_affected": "12",
      "product_status:known_not_affected": "341",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80720",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80720.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.