CVE-2026-89578

A flaw was found in the Linux kernel's device mapper I/O (dm-io) component. When handling DM_IO_BIO requests, incorrect sector-based accounting for misaligned direct I/O buffers could lead to an infinite loop. This issue can cause I/O operations to hang indefinitely, resulting in a denial of service (DoS) for the affected system. A local attacker could exploit this by performing specific misaligned direct I/O operations to a dm-mirror device.

A low impact denial of service flaw was found in the Linux kernel's device-mapper I/O (dm-io) component. When building destination bios for DM_IO_BIO requests, do_region() tracked the remaining transfer in sectors, but the source bio's vector lengths are byte-granular and need not be sector aligned. For a misaligned direct I/O buffer (for example an O_DIRECT buffer split across pages) issued to a dm-mirror device, to_sector() truncated the sub-sector remainder and the submission loop spun indefinitely issuing empty bios, hanging the I/O. A local attacker able to perform such misaligned direct I/O to an affected device-mapper target could cause those I/O operations to hang indefinitely, resulting in a denial of service; confidentiality and integrity are not affected. Red Hat Product Security assesses the impact of this flaw as low despite the moderate Red Hat CVSS:3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), because exploitation requires local access with the ability to issue misaligned direct I/O to an affected device-mapper device and the consequence is limited to hanging those I/O operations.

The vulnerable code was introduced in upstream Linux kernel 6.18, so Red Hat Enterprise Linux 6, 7, 8, and 9 kernel and kernel-rt streams, as well as OpenShift 4.x RHEL CoreOS versions, are not affected because the vulnerable code is not present in those products. Red Hat Enterprise Linux 10 (rhel-10.3 and rhel-10.4), Red Hat In-Vehicle OS 2, and OpenShift 5.0 and 5.1 are affected. The fix for the affected streams is currently deferred to a future update; until a fix is released, the residual risk remains a local denial of service through I/O hangs on affected device-mapper targets.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.