Executive brief
The Linux kernel's iomap subsystem (used for efficient I/O mapping in file systems and storage) contains a deadlock vulnerability in its bio-splitting logic. When the iomap_split_ioend function processes I/O requests, it can exhaust a shared memory pool and deadlock the system, causing storage operations to hang and making the system unresponsive.
Technical details
The vulnerability is a resource exhaustion deadlock in fs/iomap/ioend.c. The iomap_split_ioend function splits bios (block I/O structures) that may already originate from the iomap_ioend_bioset memory pool. When this function attempts to allocate a new bio from the same exhausted bioset, it causes a deadlock because all available pool entries are in use. The fix introduces a separate dedicated bio_set (iomap_ioend_split_bioset) for bio splitting operations, preventing pool exhaustion deadlock. The vulnerability is local to kernel execution (no network attack vector) and affects all systems running affected kernel versions. A patch is available and has been committed upstream.
Affected products
- Linux Linux Kernel 2.6.11 through 6.9 and later (before fix commit c679ce3be6cb63763d68ab9b5d9d73ddc0a40762)
Timeline
- 2026-08-28: disclosed
- 2026-06-29: patched: Upstream fix commit c679ce3be6cb63763d68ab9b5d9d73ddc0a40762 by Christoph Hellwig
- 2026-07-31: other: Christian Brauner marked iomap_ioend_split_bioset static to fix sparse warning