EUVD-2026-67455
GHSA-88fc-rw34-hx7h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Local I/O path deadlock requires physical or shell access; high complexity to exhaust bioset under concurrent load; low privileges sufficient to initiate filesystem I/O; no confidentiality or integrity impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
iomap: add a separate bio_set for iomap_split_ioend
iomap_split_ioend can split bios that already come from iomap_ioend_bioset and thus deadlock when the bioset is exhausted.
Add a separate bio_set to avoid this deadlock.
Christian Brauner <brauner@kernel.org> says: Mark iomap_ioend_split_bioset static as it is only used in ioend.c, fixing the sparse warning reported by the kernel test robot.
AnalysisAI
Deadlock in the Linux kernel's iomap subsystem allows local attackers to cause a denial of service by exhausting the shared bioset used by both iomap_split_ioend and its input bios. The circular dependency in bioset allocation halts I/O completion on iomap-backed filesystems (XFS, ext4 direct I/O) and can hang the affected system. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The deadlock requires concurrent I/O operations on an iomap-backed filesystem (XFS, ext4 in direct I/O, or another consumer of the iomap layer) at a volume sufficient to exhaust the `iomap_ioend_bioset` memory pool while simultaneously triggering bio splitting in `iomap_split_ioend`. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS vector (AV:N/AC:L/PR:N/UI:N) is inconsistent with the vulnerability description and should not be used for prioritization without verification. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a patched Linux kernel: version 6.18.44, 7.1.8, or 7.2 or later, per EUVD-2026-67455. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and document all Linux systems running XFS or ext4 filesystems, particularly those supporting direct I/O workloads or mission-critical applications. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today