CVE-2026-72370
Received Received - Intake

Linux Kernel Iomap Atomic DIO Page Leak

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: iomap: release pages on atomic dio size mismatch If bio_iov_iter_get_pages() or the bounce helper succeeds but builds a short bio, the REQ_ATOMIC size check rejects it before submission. The old error path only dropped the bio reference, leaving any pages already attached to the bio unreleased. Release or unbounce the pages before falling through to out_put_bio on this error path. This bug was reported by sashiko: https://sashiko.dev/#/patchset/20260608073134.95964-1-changfengnan%40bytedance.com

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72370
EUVD
EUVD-2026-59269

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of pages when a short bio is created during direct I/O operations. If a bio (block I/O) operation fails to match the expected atomic size, the error path releases the bio reference but fails to release the pages already attached to it, leading to a memory leak.

Detection Guidance

This vulnerability is specific to the Linux kernel's iomap subsystem and may not have direct network detection methods. Check kernel logs for I/O errors or crashes related to atomic direct I/O operations. Commands like dmesg | grep -i iomap or journalctl -k | grep -i iomap may help identify issues.

Impact Analysis

This vulnerability could lead to memory exhaustion over time due to unreleased pages, potentially causing system instability or crashes. It primarily affects systems using direct I/O operations with the Linux kernel.

Mitigation Strategies

Update the Linux kernel to the latest patched version. If immediate patching is not possible, avoid using atomic direct I/O operations or applications relying on them until the kernel is updated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72370. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart