Executive brief
The Linux kernel's device mapper (dm-io) component could hang indefinitely when handling misaligned direct I/O operations to mirrored devices. A flaw in how the code processed unaligned memory buffers caused it to submit empty I/O requests in a loop, effectively freezing operations that depend on the mirror target. This hang can disrupt storage services that rely on device mapper mirroring.
Technical details
The vulnerability is an infinite loop in the dm-io driver's do_region() function. When processing DM_IO_BIO requests with misaligned O_DIRECT buffers, the code would walk the source bio's biovec and rebuild it page-by-page while tracking remaining transfer in sectors. Because biovec lengths are byte-granular and may not be sector-aligned, truncation via to_sector() could lose sub-sector fragments, causing the loop to submit empty bios indefinitely. The fix replaces the manual page-copying reconstruction with bio_alloc_clone(), which clones the source biovec directly and lets the block layer handle target-specific splitting. No authentication is required; any local process with direct I/O access to a dm-mirror device can trigger the hang. The patch was committed upstream in June 2026 and backported to stable kernels.
Affected products
- Linux Linux Kernel multiple (see stable kernel branches)
Timeline
- 2026-09-11: disclosed
- 2026-06-16: patched: Fix committed upstream by Keith Busch; backported to stable branches by 2026-09-07