Executive brief
A vulnerability in the Linux kernel's file handling system could allow a local user to cause a system crash. The issue occurs during specific file reading operations when an error happens at the same time a file is being truncated or deleted. This race condition leads to a kernel panic, potentially disrupting services or causing data loss on the affected system.
Technical details
A race condition exists in fs/iomap/buffered-io.c within the iomap_finish_folio_read() function. When a buffered read fails, the kernel attempts to report the error using a pointer that may have been cleared by a concurrent truncate operation. Specifically, if the 'read_bytes_pending' counter is decremented before error reporting, the folio may be unlocked and detached, setting folio->mapping to NULL. A subsequent call to fserror_report_io() then dereferences this NULL pointer. This is a local attack vector requiring specific timing (race condition) to trigger a Denial of Service (kernel panic). The issue has been resolved by reordering the operations to report the error before decrementing the pending byte counter.
Affected products
- Linux Linux 7.0 to 7.0.13, 7.1
Timeline
- 2026-06-03: other: Patch authored
- 2026-06-25: advisory: NVD publication date