Executive brief
The Linux kernel's device mapper (dm) module, which is used to virtualize block storage devices, contains a flaw in its bio polling mechanism. When using io_uring with IOPOLL on certain dm targets like dm-stripe, a task can become stuck in continuous polling operations long enough to trigger an RCU (Read-Copy-Update) CPU stall detection, effectively freezing the system and causing a denial of service.
Technical details
The vulnerability exists in the dm_poll_bio() function in drivers/md/dm.c, which implements the ->poll_bio() callback for stacked dm devices. The root cause is that polling flags from the upper layer (io_uring) are passed unchanged to target queue polling via bio_poll(), allowing blk_mq_poll() to spin on a target queue indefinitely. On dm-stripe targets with io_uring IOPOLL, this can keep a task in the call chain dm_poll_bio() -> bio_poll() -> blk_mq_poll() long enough to trigger an RCU CPU stall before io_uring returns to io_iopoll_check() for rescheduling checks. The fix forces one-shot polling for target bios by adding the BLK_POLL_ONESHOT flag, allowing the caller to reinvoke polling and check for rescheduling between passes. This requires no special authentication and is exploitable by any user-mode process using io_uring with IOPOLL.
Affected products
- Linux Linux kernel
Timeline
- 2026-08-15: disclosed
- 2026-05-18: patched