CVE-2026-89770

Received Received - Intake

NULL Pointer Dereference in Linux Kernel iomap

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: iomap: don't free integrity payload that doesn't exist fs_bio_integrity_alloc might not allocate a bio integrity payload if PI verification is disabled on the block device. Check for that case before calling fs_bio_integrity_free in iomap_bio_read_folio_range_sync to avoid a NULL pointer dereferences. Make the branch cover the PI verification as well - while fs_bio_integrity_verify works without an integrity payload, it requires one to actually do useful work.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89770

EUVD

EUVD-2026-76682

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a NULL pointer dereference issue in the iomap subsystem. When PI verification is disabled on a block device, fs_bio_integrity_alloc may not allocate a bio integrity payload. The code then attempts to free this non-existent payload in iomap_bio_read_folio_range_sync, leading to a crash.

Detection Guidance

This vulnerability is specific to the Linux kernel and relates to a NULL pointer dereference in the iomap subsystem. Detection requires checking kernel logs for crashes or errors related to bio integrity handling. Commands like dmesg | grep -i 'iomap' or journalctl -k | grep -i 'iomap' may help identify issues. Ensure your kernel version is updated to a patched release.

Impact Analysis

This vulnerability could cause system crashes or instability if exploited, potentially leading to denial of service. It affects systems using the Linux kernel with block devices where PI verification is disabled.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, disable block device PI verification as a temporary workaround, but note this may reduce data integrity protections.

Hi! I’m here to help you understand CVE-2026-89770. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70