Executive brief
A memory cleanup bug in the Linux kernel's input/output mapping (iomap) subsystem fails to properly release folio batches (collections of memory pages) when filesystem callbacks encounter errors. While the practical risk is currently low, the fix prevents potential memory leaks in error conditions that could affect system stability.
Technical details
The vulnerability is a resource cleanup issue in fs/iomap/iter.c where the folio batch mechanism used for iomap zero range operations failed to release batches in error paths. Specifically, if iomap_begin() or iomap_end() callbacks returned errors, direct return statements bypassed the batch cleanup helper. The iomap_end() case has no known exploitable path, but XFS could theoretically trigger the iomap_begin() error case. The fix adds proper error handling branches to invoke iomap_iter_clean_fbatch() and refactors the cleanup helper to unconditionally clear the IOMAP_F_FOLIO_BATCH flag and release populated batches, ensuring cleanup occurs even when flags are not set in error conditions.
Affected products
- Linux Linux kernel multiple versions (see patch history)
Timeline
- 2026-09-17: disclosed
- 2026-07-31: patched: Fix committed upstream