CVE-2026-72370

A flaw was found in the Linux kernel's iomap subsystem. When handling atomic direct I/O (DIO) operations, if a bio (a data structure representing I/O requests) is built with a size mismatch and subsequently rejected, the kernel's error handling path fails to release the associated memory pages. This oversight can lead to a resource leak, potentially causing memory exhaustion and a Denial of Service (DoS) condition on the affected system.

A low impact resource leak was found in the Linux kernel iomap direct I/O (DIO) subsystem. When an atomic direct I/O write builds a short bio that is rejected by the REQ_ATOMIC size check before submission, the error path drops the bio reference without releasing the pages already attached to the bio. A local user able to issue atomic direct writes to a writable file on a filesystem supporting this feature could repeatedly trigger this error path, leaking kernel memory pages and potentially causing memory exhaustion and a denial of service. The kernel in Red Hat Enterprise Linux 10.2 and 10.3 and in Red Hat In-Vehicle OS 2.0 and 2.1 (kernel and kernel-ivos-qualcomm components) is affected, with the fix currently deferred; the residual risk is limited to local denial of service through gradual memory and resource exhaustion. Earlier Red Hat Enterprise Linux streams (RHEL 6, 7, 8, 9, and RHEL 10.0) are not affected because the iomap atomic write support that introduced this error path is not present in those versions. Although the Red Hat CVSS 3.1 base score is 5.5 (Moderate) due to the high availability impact in its vector, Red Hat rates the overall impact of this flaw as low because exploitation requires local access, privileges to issue direct I/O, a filesystem supporting atomic writes, and repeated deliberate triggering of the error path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.