CVE-2026-90396

A flaw was found in the Linux kernel's block direct I/O (DIO) subsystem. When an integrity mapping fails during direct I/O operations, a reference to the direct I/O resource is not properly released. This resource leak could potentially be exploited by a local attacker, leading to a denial of service (DoS) due to resource exhaustion over time.

This vulnerability is rated as Low severity because triggering the resource leak requires local access and depends on uncommon direct I/O metadata mapping failures to cause gradual memory exhaustion. The issue is confined to error-handling paths within the kernel block subsystem and does not permit privilege escalation or compromise system confidentiality or integrity. Exploiting the flaw requires sustained local I/O activity under specific error conditions, significantly limiting practical risk in standard enterprise deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.