Executive brief
The Linux kernel's block I/O subsystem can leak direct I/O (dio) references when metadata integrity mapping fails during read or write operations. This causes system resource exhaustion and can lead to service degradation or kernel hangs as pending I/O operations are not properly cleaned up.
Technical details
This vulnerability is a resource leak in block/fops.c within the __blkdev_direct_IO() function. When bio_integrity_map_iter() fails, the original code uses "goto fail" which bypasses proper bio ending logic, leaving dio references held. The fix changes the error path to call bio_endio_status() and break from the loop, ensuring the full bio ending sequence is executed for previously submitted bios. The vulnerability affects direct I/O operations with metadata when the IOCB_HAS_METADATA flag is set and integrity mapping encounters an error. No special preconditions are required beyond performing direct block I/O with metadata.
Affected products
- Linux Linux kernel affected versions across multiple stable branches from 2.6.x through 7.x
Timeline
- 2026-07-20: other: Vulnerability fix committed by Keith Busch
- 2026-09-17: disclosed: CVE-2026-90396 published