CVE-2026-80720

CVE-2026-80720 is an availability bug in the Linux kernel's iomap I/O layer: the iomap_split_ioend helper allocates the bios it creates from the same memory pool (iomap_ioend_bioset) that supplied the bios being split. When that pool is exhausted, typically under memory pressure combined with write patterns that force ioend splitting on filesystems using iomap, the allocation blocks waiting for bios that can never complete, deadlocking the I/O path. An attacker able to drive such I/O remotely (consistent with the network attack vector, e.g., a client hammering a file server backed by an iomap-based filesystem) can hang storage I/O and cause a denial of service; there is no confidentiality or integrity impact. Any Linux system running a kernel with the affected iomap code is potentially exposed, with file servers and storage appliances using iomap-based filesystems the most plausible victims; the advisory does not specify affected or fixed version ranges. No public proof-of-concept is known, the flaw is not in CISA's KEV, and EPSS puts 30-day exploitation probability at roughly 0.3%, so no exploitation is currently known.

What to do: Update affected systems to a kernel that includes the fix adding the dedicated iomap_ioend_split_bioset ('iomap: add a separate bio_set for iomap_split_ioend'); the advisory lists no fixed version number, so check your vendor's kernel advisories for this commit or CVE. Since no exploit or PoC is known, treat this as a hardening priority rather than an emergency. On hosts with heavy write workloads on iomap-based filesystems, monitor for hung I/O or stuck kworker tasks and reboot/recover if the storage path stalls.