Cloudanix VulnDB

CVE-2026-89770

None

CVSS

—

EPSS

0.2%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Linux kernel can make computers crash when reading from certain storage devices.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability is a NULL pointer dereference in the iomap subsystem of the Linux kernel, occurring when fs_bio_integrity_free is called on a bio integrity payload that fs_bio_integrity_alloc never created because PI verification is disabled on the block device.

Why it matters to the business

Kernel panics and system crashes can occur during normal I/O operations, leading to denial of service, unplanned downtime, and potential data loss on Linux servers and devices.

How an attack unfolds

An attacker triggers I/O read operations on a block device with PI verification disabled; the code path in iomap_bio_read_folio_range_sync then attempts to free a non-existent integrity payload, dereferencing NULL and crashing the kernel.

How to fix it

Apply the upstream kernel patch that adds an existence check before calling fs_bio_integrity_free and also covers the PI verification path; rebuild and deploy updated kernels across all affected systems.

How to confirm the fix worked

Confirm the fix is present by inspecting the iomap source for the payload-existence guard before fs_bio_integrity_free and by running regression tests that exercise both enabled and disabled PI verification paths.

Typical attack path

  1. Locate or configure a block device with PI verification disabled
  2. Initiate bio read folio operations that reach iomap_bio_read_folio_range_sync
  3. Trigger the unconditional call to fs_bio_integrity_free on a NULL payload

How to detect it

Search kernel logs and dmesg for NULL pointer dereference faults originating from iomap_bio_read_folio_range_sync or fs_bio_integrity_free; correlate with block devices that have PI verification disabled.

  • iomap_bio_read_folio_range_sync
  • fs_bio_integrity_free
  • NULL pointer dereference
  • bio integrity payload

What your security team should do

  • Prioritize kernel updates on all production Linux systems handling block I/O
  • Monitor kernel logs for oops and NULL dereference signatures in iomap functions
  • Test the patched kernel in staging environments before broad rollout

The record

In the Linux kernel, the following vulnerability has been resolved: iomap: don't free integrity payload that doesn't exist fs_bio_integrity_alloc might not allocate a bio integrity payload if PI verification is disabled on the block device. Check for that case before calling fs_bio_integrity_free in iomap_bio_read_folio_range_sync to avoid a NULL pointer dereferences. Make the branch cover the PI verification as well - while fs_bio_integrity_verify works without an integrity payload, it requires one to actually do useful work.

Affected packages

Ecosystem Package Introduced Fixed