Executive brief
The Linux kernel's input/output mapping (iomap) subsystem contains a flaw in how it handles data integrity metadata when reading file system pages. When a block device has protection information (PI) verification disabled, the kernel could attempt to free memory that was never allocated, causing a crash that disrupts system availability.
Technical details
The vulnerability is a NULL pointer dereference in the iomap bio integrity code path (fs/iomap/bio.c). The root cause is that fs_bio_integrity_alloc may fail to allocate a bio integrity payload when PI (Protection Information) verification is disabled on the block device, but the code unconditionally calls fs_bio_integrity_free without checking whether the payload actually exists. The fix changes the condition from checking IOMAP_F_INTEGRITY flags to calling bio_integrity() to verify the payload was actually allocated before attempting to free or verify it. This is a local kernel bug with no network attack vector, but can be triggered during normal file I/O operations on systems with certain block device configurations.
Affected products
- Linux Linux kernel 7.1 and later
Timeline
- 2026-09-11: disclosed
- 2026-08-12: patched