HIGH Introduced in 6.15
iomap IoendSplit Deadlock
CVE-2026-80720
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
KernelScan AI5.1MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: iomap: add a separate bio_set for iomap_split_ioend iomap_split_ioend can split bios that already come from iomap_ioend_bioset and thus deadlock when the bioset is exhausted. Add a separate bio_set to avoid this deadlock. Christian Brauner <brauner@kernel.org> says: Mark iomap_ioend_split_bioset static as it is only used in ioend.c, fixing the sparse warning reported by the kernel test robot.
02KernelScan AI Analysis
Risk summary
A local user performing I/O on a filesystem using the iomap framework can trigger a deadlock in the kernel's block layer when bio splitting is required. The deadlock occurs because the same bio_set memory pool is used for both the original bio allocation and the subsequent bio split operation, exhausting the pool and causing the split to wait for memory that can never be freed. This results in a system hang or denial of service.
Vulnerability analysis
The iomap subsystem uses a single memory pool for both allocating I/O operations and splitting them when they exceed hardware limits. Under heavy I/O, the pool can become exhausted, causing a split operation to block waiting for resources that are held by the very operation requesting them. This circular wait deadlocks the kernel. The fix introduces a separate memory pool dedicated to the split path, so that splitting never competes with original allocations. Any local user with write access to a file on an affected filesystem can trigger this by issuing large writes that require splitting; no special privileges are needed beyond normal filesystem access.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| mainline | 6.15 | 7.2 | c679ce3be6cb |
| 7.1 | 6.15 | 7.1.8 | 4a869be56e9f |
| 6.18 | 6.15 | 6.18.44 | cfc686a1174a |