CVE-2026-80720 Overview
CVE-2026-80720 is a denial-of-service vulnerability in the Linux kernel's iomap subsystem. The flaw exists in the iomap_split_ioend function, which can split bios that already originate from iomap_ioend_bioset. This creates a deadlock condition when the bioset is exhausted, freezing filesystem I/O operations that rely on iomap.
The kernel maintainers resolved the issue by introducing a separate bio_set dedicated to iomap_split_ioend, breaking the circular allocation dependency. A follow-up change from Christian Brauner marked iomap_ioend_split_bioset as static to address a sparse warning.
Critical Impact
Attackers or heavy I/O workloads can trigger a kernel deadlock in filesystems using iomap (such as XFS and ext4 with iomap-based paths), resulting in unresponsive storage and system-wide denial of service.
Affected Products
- Linux kernel versions containing the iomap_split_ioend code path prior to the fix
- Filesystems built on the iomap infrastructure (including XFS and ext4 with iomap)
- Distributions shipping unpatched upstream stable kernels
Discovery Timeline
- 2026-08-28 - CVE-2026-80720 published to the National Vulnerability Database
- 2026-08-29 - Last updated in NVD database
Technical Details for CVE-2026-80720
Vulnerability Analysis
The Linux kernel iomap layer provides a common infrastructure for filesystems to manage buffered and direct I/O. When large writes complete, the kernel may need to split an ioend structure into multiple bios for accounting and completion handling. The iomap_split_ioend function performs this split by allocating new bios from iomap_ioend_bioset.
The defect arises because the bios being split can themselves already be allocated from iomap_ioend_bioset. Under memory pressure or heavy I/O, the bioset can become exhausted while a caller holds an allocation and simultaneously requests another from the same pool. Because biosets enforce forward-progress guarantees only for non-recursive callers, the recursive allocation stalls indefinitely, producing a deadlock.
The fix introduces iomap_ioend_split_bioset, a dedicated bio pool used exclusively by the split path. Separating the pools eliminates the recursive dependency and restores forward progress under I/O load.
Root Cause
The root cause is a recursive bio_set allocation in iomap_split_ioend. The function drew from the same pool that supplied its input bios, violating the bioset allocation model. Under exhaustion, this produces a resource deadlock rather than backpressure.
Attack Vector
Triggering the condition requires sustained or large write I/O to a filesystem using iomap, sufficient to exhaust iomap_ioend_bioset. While the CVSS vector lists a network attack vector, exploitation in practice depends on generating filesystem write pressure that reaches the vulnerable split path. On network-facing systems (NFS servers, storage backends, container hosts), remote workloads that drive heavy writes can reach the code path.
Exploitation code is not required. See the upstream commits 4a869be, c679ce3, and cfc686a for the fix details.
Detection Methods for CVE-2026-80720
Indicators of Compromise
- Kernel hung task warnings referencing iomap_split_ioend, iomap_finish_ioend, or filesystem writeback threads (kworker, xfsaild).
- Processes stuck in uninterruptible sleep (D state) waiting on I/O completion for extended periods.
- dmesg entries reporting bio allocation stalls or bio_alloc warnings tied to iomap_ioend_bioset.
Detection Strategies
- Monitor kernel logs for hung_task_timeout_secs messages that include iomap or writeback call stacks.
- Track running kernel version via uname -r and compare against distribution advisories referencing the upstream commits.
- Baseline filesystem write latency and alert on sustained deviations that correlate with kworker stalls.
Monitoring Recommendations
- Enable /proc/sys/kernel/hung_task_panic or hung task logging on production storage nodes to capture deadlocks.
- Collect dmesg, /proc/*/stack, and /sys/kernel/debug/block/* snapshots when write latency alerts fire.
- Forward kernel telemetry to a centralized log platform and correlate with I/O throughput metrics.
How to Mitigate CVE-2026-80720
Immediate Actions Required
- Inventory Linux hosts and identify kernels containing the vulnerable iomap_split_ioend path.
- Apply vendor-provided kernel updates that incorporate upstream commits 4a869be, c679ce3, and cfc686a.
- Prioritize patching for storage servers, NFS exporters, database hosts, and container nodes with heavy write workloads.
- Reboot systems after upgrading the kernel package to activate the fix.
Patch Information
The fix adds a dedicated iomap_ioend_split_bioset to break the recursive allocation between iomap_split_ioend and iomap_ioend_bioset. A follow-up change marks the new bioset as static to resolve a sparse warning. Backports are available in stable branches; consult your Linux distribution's advisories to identify the exact package versions carrying the fix.
Workarounds
- Reduce sustained write pressure on affected filesystems until the kernel is patched.
- Where feasible, throttle bulk write workloads using cgroup I/O controllers to lower the chance of bioset exhaustion.
- Increase system memory headroom on storage-heavy nodes to delay bioset pressure, treating this only as a temporary measure.
# Verify kernel version and check for the fix in distribution changelog
uname -r
rpm -q --changelog kernel | grep -i iomap_split_ioend # RHEL-based
apt changelog linux-image-$(uname -r) | grep -i iomap # Debian/Ubuntu
# Enable hung task detection to surface deadlocks early
sysctl -w kernel.hung_task_timeout_secs=120
sysctl -w kernel.hung_task_warnings=10
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
