Description
In the Linux kernel, the following vulnerability has been resolved:

iomap: add a separate bio_set for iomap_split_ioend

iomap_split_ioend can split bios that already come from
iomap_ioend_bioset and thus deadlock when the bioset is exhausted.

Add a separate bio_set to avoid this deadlock.

Christian Brauner <brauner@kernel.org> says:
Mark iomap_ioend_split_bioset static as it is only used in ioend.c,
fixing the sparse warning reported by the kernel test robot.
Published: 2026-08-28
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via kernel deadlock
Action: Patch Immediately
AI Analysis

Impact

A concurrency defect in the Linux kernel’s iomap subsystem can cause a deadlock when the iomap_split_ioend function processes more bios than the dedicated bio_set can hold. The suspension of I/O handling leads the kernel to become non‑responsive, effectively denying service to all running processes. The flaw is a classic deadlock scenario that can reduce system availability.

Affected Systems

The issue applies to all Linux kernel implementations that have not incorporated the patch referenced in the provided Git commit links. No specific version range is listed, so any kernel using the affected iomap code is potentially vulnerable.

Risk and Exploitability

The CVSS score is 7.5, indicating a high severity, and the EPSS score is less than 1%, suggesting a very low probability of exploitation in the wild. Based on the description, it is inferred that an attacker could trigger the deadlock by inducing a high volume of I/O operations that exhaust the bio_set. The vulnerability is not listed in the CISA KEV catalog, but the lack of exploitation data does not preclude the possibility of a denial‑of‑service attack once the kernel is vulnerable.

Generated by OpenCVE AI on September 2, 2026 at 02:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest kernel update that incorporates the iomap patch identified in the commit URLs; check the distribution’s security advisories for the correct release.
  • If a new kernel release is not yet available, limit or stagger large I/O workloads that may exhaust the bio_set to mitigate the risk of a deadlock.
  • Continuously monitor kernel logs (e.g., via dmesg) for I/O deadlock or bio_set exhaustion messages and apply standard system hardening practices to reduce service impact.

Generated by OpenCVE AI on September 2, 2026 at 02:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-665

Tue, 01 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-833
References
Metrics threat_severity

None

threat_severity

Moderate


Sat, 29 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}


Fri, 28 Aug 2026 16:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-665

Fri, 28 Aug 2026 13:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-667

Fri, 28 Aug 2026 10:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-667

Fri, 28 Aug 2026 07:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: iomap: add a separate bio_set for iomap_split_ioend iomap_split_ioend can split bios that already come from iomap_ioend_bioset and thus deadlock when the bioset is exhausted. Add a separate bio_set to avoid this deadlock. Christian Brauner <brauner@kernel.org> says: Mark iomap_ioend_split_bioset static as it is only used in ioend.c, fixing the sparse warning reported by the kernel test robot.
Title iomap: add a separate bio_set for iomap_split_ioend
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-29T06:22:35.780Z

Reserved: 2026-08-26T14:34:25.788Z

Link: CVE-2026-80720

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-28T08:16:57.810

Modified: 2026-08-29T07:16:53.473

Link: CVE-2026-80720

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-28T00:00:00Z

Links: CVE-2026-80720 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-02T03:00:13Z

Weaknesses