CVE-2026-80720

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80720", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.788Z", "datePublished": "2026-08-28T06:53:16.683Z", "dateUpdated": "2026-08-29T06:22:35.780Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-29T06:22:35.780Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niomap: add a separate bio_set for iomap_split_ioend\n\niomap_split_ioend can split bios that already come from\niomap_ioend_bioset and thus deadlock when the bioset is exhausted.\n\nAdd a separate bio_set to avoid this deadlock.\n\nChristian Brauner <brauner@kernel.org> says:\nMark iomap_ioend_split_bioset static as it is only used in ioend.c,\nfixing the sparse warning reported by the kernel test robot."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - On ZNS-backed XFS realtime volumes exported via nfsd/ksmbd, remote client write I/O reaches vfs_write()->xfs_zone_alloc_and_submit()->iomap_split_ioend() in the server kernel without local shell access.\nAC:L - An attacker with write access can deterministically exhaust the 32-entry iomap_ioend_bioset via concurrent large zoned writes or direct I/O needing multiple bio_split allocations from the same pool; they control thread count and I/O size without uncontrollable races.\nPR:N - Triggering requires only permission to write realtime files on an XFS zoned filesystem via local syscall or network NFS/SMB client write; no CAP_SYS_ADMIN, ioctl, or init-namespace root is needed beyond write access to exported storage.\nUI:N - The attacker triggers the deadlock with their own concurrent write or direct-I/O requests; no separate victim must mount media, open a file, or perform any interactive action beyond the attacker's own I/O.\nS:U - The bioset mempool deadlock freezes zoned XFS I/O within the same host kernel security authority; it does not cross a VM, IOMMU, or sandbox boundary.\nC:N - This is a mempool self-deadlock with no memory corruption, out-of-bounds access, use-after-free, or information disclosure; bio_split failure returns -ENOMEM rather than leaking kernel data.\nI:N - The bug causes tasks to block indefinitely on mempool allocation but does not corrupt, modify, or overwrite file data or enable arbitrary writes or code execution.\nA:H - When iomap_ioend_bioset is exhausted, bio_split blocks on mempool_alloc() while holders cannot release entries, deadlocking writeback workers and zoned submit paths and hanging all I/O on the affected XFS zoned filesystem."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/iomap/ioend.c"], "versions": [{"version": "5fcbd555d48390a8c819ba7fdf55fbfcabe05c80", "lessThan": "cfc686a1174aa904dcad9b9a7c5e46b484d27e4e", "status": "affected", "versionType": "git"}, {"version": "5fcbd555d48390a8c819ba7fdf55fbfcabe05c80", "lessThan": "4a869be56e9f6ce7462abcf324ebdefc5de051be", "status": "affected", "versionType": "git"}, {"version": "5fcbd555d48390a8c819ba7fdf55fbfcabe05c80", "lessThan": "c679ce3be6cb63763d68ab9b5d9d73ddc0a40762", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/iomap/ioend.c"], "versions": [{"version": "6.15", "status": "affected"}, {"version": "0", "lessThan": "6.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.44", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.8", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.18.44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.1.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/cfc686a1174aa904dcad9b9a7c5e46b484d27e4e"}, {"url": "https://git.kernel.org/stable/c/4a869be56e9f6ce7462abcf324ebdefc5de051be"}, {"url": "https://git.kernel.org/stable/c/c679ce3be6cb63763d68ab9b5d9d73ddc0a40762"}], "title": "iomap: add a separate bio_set for iomap_split_ioend", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/iomap/ioend.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "cfc686a1174aa904dcad9b9a7c5e46b484d27e4e", "status": "affected", "version": "5fcbd555d48390a8c819ba7fdf55fbfcabe05c80", "versionType": "git"}, {"lessThan": "4a869be56e9f6ce7462abcf324ebdefc5de051be", "status": "affected", "version": "5fcbd555d48390a8c819ba7fdf55fbfcabe05c80", "versionType": "git"}, {"lessThan": "c679ce3be6cb63763d68ab9b5d9d73ddc0a40762", "status": "affected", "version": "5fcbd555d48390a8c819ba7fdf55fbfcabe05c80", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/iomap/ioend.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"lessThan": "6.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.44", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niomap: add a separate bio_set for iomap_split_ioend\n\niomap_split_ioend can split bios that already come from\niomap_ioend_bioset and thus deadlock when the bioset is exhausted.\n\nAdd a separate bio_set to avoid this deadlock.\n\nChristian Brauner <brauner@kernel.org> says:\nMark iomap_ioend_split_bioset static as it is only used in ioend.c,\nfixing the sparse warning reported by the kernel test robot."}], "id": "CVE-2026-80720", "lastModified": "2026-08-29T07:16:53.473", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-28T08:16:57.810", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4a869be56e9f6ce7462abcf324ebdefc5de051be"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c679ce3be6cb63763d68ab9b5d9d73ddc0a40762"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cfc686a1174aa904dcad9b9a7c5e46b484d27e4e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: iomap: add a separate bio_set for iomap_split_ioend", "id": "2525424", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525424"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-833", "details": ["In the Linux kernel, the following vulnerability has been resolved:\niomap: add a separate bio_set for iomap_split_ioend\niomap_split_ioend can split bios that already come from\niomap_ioend_bioset and thus deadlock when the bioset is exhausted.\nAdd a separate bio_set to avoid this deadlock.\nChristian Brauner <brauner@kernel.org> says:\nMark iomap_ioend_split_bioset static as it is only used in ioend.c,\nfixing the sparse warning reported by the kernel test robot.", "A flaw was found in the iomap component of the Linux kernel. The `iomap_split_ioend` function can cause a deadlock when it attempts to split bios that originate from `iomap_ioend_bioset` and the bioset is exhausted. This can lead to a system hang, resulting in a Denial of Service (DoS) for affected systems."], "name": "CVE-2026-80720", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-80720\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-80720\nhttps://lore.kernel.org/linux-cve-announce/2026082810-CVE-2026-80720-fb94@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5fcbd555d48390a8c819ba7fdf55fbfcabe05c80,cfc686a1174aa904dcad9b9a7c5e46b484d27e4e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5fcbd555d48390a8c819ba7fdf55fbfcabe05c80,4a869be56e9f6ce7462abcf324ebdefc5de051be)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5fcbd555d48390a8c819ba7fdf55fbfcabe05c80,c679ce3be6cb63763d68ab9b5d9d73ddc0a40762)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.44,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.8,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-28T10:30:17.947460+00:00", "updated": "2026-09-02T03:00:13.989489+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}