CVE-2026-30656
Received Received - Intake

NULL Pointer Dereference in fio v3.41 Causes Process Crash

Publication date: 2026-04-16

Last updated on: 2026-04-16

Assigner: MITRE

Description
A NULL pointer dereference vulnerability exists in fio (Flexible I/O Tester) v3.41 when parsing job files containing the fdp_pli option. The callback function str_fdp_pli_cb() does not validate the input pointer and calls strdup() on a NULL value when the option is specified without an argument. This results in a segmentation fault and process crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-04-16
Last Modified
2026-04-16
Generated
2026-07-06
AI Q&A
2026-04-16
EPSS Evaluated
2026-07-05
NVD
CVE-2026-30656
EUVD
EUVD-2026-23245

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
fio flexible_i_o_tester 3.41

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a NULL pointer dereference in the Flexible I/O Tester (fio) version 3.41. It occurs when parsing job files that contain the fdp_pli option without an argument. The function str_fdp_pli_cb() does not check if the input pointer is NULL before calling strdup() on it, which leads to a segmentation fault and causes the process to crash.

Impact Analysis

The impact of this vulnerability is that it can cause the fio process to crash due to a segmentation fault when processing certain job files. This could lead to denial of service if fio is used in automated testing or performance measurement environments.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-30656. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart