CVE-2026-89770: Linux Kernel iomap Use-After-Free Vulnerability

CVE-2026-89770 Overview

CVE-2026-89770 is a NULL pointer dereference vulnerability in the Linux kernel's iomap subsystem. The flaw resides in iomap_bio_read_folio_range_sync, which calls fs_bio_integrity_free without first verifying that a bio integrity payload was allocated. When Protection Information (PI) verification is disabled on a block device, fs_bio_integrity_alloc skips payload allocation, leading to a NULL dereference on the subsequent free path. The upstream fix adds a guard covering both the payload free and the PI verification call, since fs_bio_integrity_verify requires an integrity payload to perform useful work.

Critical Impact
A NULL pointer dereference in the iomap read path can trigger a kernel oops and denial of service on systems performing buffered reads against block devices with PI verification disabled.

Affected Products

Linux kernel (mainline) versions containing the iomap_bio_read_folio_range_sync code path prior to commits 65651f1001aa and 8a8685b32c07
Distributions shipping kernels with iomap-based filesystem read paths (for example XFS, ext4 with iomap, Btrfs iomap conversions)
Storage stacks operating on block devices where Protection Information (PI) verification is disabled

Discovery Timeline

2026-09-11 - CVE-2026-89770 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89770

Vulnerability Analysis

The defect exists in the iomap read completion path used by modern Linux filesystems. During buffered I/O, fs_bio_integrity_alloc allocates a bio integrity payload to carry Protection Information metadata such as Data Integrity Field (DIF) or T10 PI tags. When PI verification is disabled on the underlying block device, this allocation is skipped and the bio's integrity pointer remains NULL.

The function iomap_bio_read_folio_range_sync then unconditionally calls fs_bio_integrity_free on completion. Dereferencing the absent integrity payload causes a kernel NULL pointer fault. The same code path also invokes fs_bio_integrity_verify, which tolerates a missing payload without crashing but performs no meaningful verification when one is absent.

Root Cause

The root cause is a missing precondition check [CWE-476: NULL Pointer Dereference]. The iomap read path assumed the integrity payload was always allocated when integrity support was compiled in. It did not account for the runtime configuration in which PI verification is disabled per-device and allocation is elided.

Attack Vector

Triggering the fault requires buffered read I/O against a block device whose PI verification is disabled. This is a local, kernel-context condition typically reached by ordinary filesystem workloads rather than by a crafted remote payload. The observable impact is a kernel oops and denial of service on the affected mount. No exploit code is public and the flaw is not listed in CISA KEV.

A sanitized code example is not included because no verified proof-of-concept is available. Refer to the upstream commits 65651f1001aa and 8a8685b32c07 for the exact patch diff.

Detection Methods for CVE-2026-89770

Indicators of Compromise

Kernel oops or panic messages referencing iomap_bio_read_folio_range_sync or fs_bio_integrity_free in dmesg and /var/log/kern.log
Repeated I/O errors or process hangs on filesystems mounted over block devices with PI verification disabled
Unexpected reboots or system crashes correlated with buffered read workloads on affected kernels

Detection Strategies

Inventory running kernel versions and compare against the fixed commits 65651f1001aa and 8a8685b32c07 to identify unpatched hosts
Query block device integrity state through sysfs under /sys/block/<dev>/integrity/ to enumerate devices where PI verification is disabled
Correlate kernel crash telemetry with iomap and bio-integrity symbols in stack traces

Monitoring Recommendations

Ship kernel logs and crash dumps to a centralized log platform and alert on stack frames containing fs_bio_integrity_free
Track host uptime and unexpected reboot events across storage-heavy servers
Monitor filesystem error counters and SMART data on devices where integrity features are toggled

How to Mitigate CVE-2026-89770

Immediate Actions Required

Identify hosts running Linux kernels lacking the upstream fix and prioritize patch scheduling for storage-tier systems
Apply vendor kernel updates that incorporate commits 65651f1001aa and 8a8685b32c07
Reboot affected hosts after patching to ensure the fixed kernel image is loaded

Patch Information

The fix is committed to the upstream Linux kernel in 65651f1001aa and 8a8685b32c07. The patch adds a NULL check guarding both fs_bio_integrity_free and fs_bio_integrity_verify in iomap_bio_read_folio_range_sync. Distribution vendors are expected to backport the fix into stable and long-term support kernel branches.

Workarounds

Where operationally acceptable, enable Protection Information verification on block devices so fs_bio_integrity_alloc always produces a payload
Avoid mounting iomap-backed filesystems on block devices with PI disabled on unpatched kernels
Restrict untrusted workloads on affected hosts until the kernel is updated

bash

# Configuration example: inspect PI verification state per block device
for dev in /sys/block/*/integrity/; do
  echo "Device: ${dev}"
  cat "${dev}/format" 2>/dev/null
  cat "${dev}/read_verify" 2>/dev/null
  cat "${dev}/write_generate" 2>/dev/null
done