CVE-2026-80720

A flaw was found in the iomap component of the Linux kernel. The iomap_split_ioend function can cause a deadlock when it attempts to split bios that originate from iomap_ioend_bioset and the bioset is exhausted. This can lead to a system hang, resulting in a Denial of Service (DoS) for affected systems.

A denial of service flaw of moderate impact was found in the iomap subsystem of the Linux kernel as shipped in Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2. The iomap_split_ioend() function can split bios that were originally allocated from the iomap_ioend_bioset mempool; when that mempool is exhausted, the split operation blocks waiting for memory that cannot be freed until in-flight I/O completes, resulting in a deadlock that hangs filesystem I/O. A local user able to perform file I/O on an affected mounted filesystem can trigger this condition, with reliable triggering depending on storage and filesystem configuration, causing a system hang or filesystem I/O stall (denial of service). No confidentiality or integrity impact is supported by the evidence. Red Hat Enterprise Linux 6, 7, 8, and 9 streams and Red Hat Enterprise Linux 10.0 are not affected because the iomap bio-splitting code that introduced this flaw is not present in those kernels. For the affected Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 streams the fix is currently deferred to a future update; until then the residual risk is a local denial of service through an I/O deadlock when the bioset mempool becomes exhausted. The upstream CVE record assigns a CVSS score of 7.5 with a network attack vector, while Red Hat rates this flaw moderate with a CVSS score of 5.5 and a local attack vector because the issue is not network-reachable and requires local access to perform file I/O on an affected system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.