CVE-2026-30656 Null dereference in n/a
Attackers can cause a denial of service in fio by providing a malformed job file with the fdp_pli option, leading to a crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-30656?
CVE-2026-30656 is a high-severity vulnerability in n/a, published on 16 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A NULL pointer dereference vulnerability exists in fio (Flexible I/O Tester) v3.41 when parsing job files containing the fdp_pli option. The callback function str_fdp_pli_cb() does not validate the input pointer and calls strdup() on a NULL value when the option is specified without an argument. This results in a segmentation fault and process crash.
Weakness: CWE-476
Which versions are affected by CVE-2026-30656?
Linux distribution packages (1)
fio openSUSE:Tumbleweed | All versions | 3.43-1.1 |
How do I fix CVE-2026-30656?
Upgrade to a fixed version.
Is CVE-2026-30656 being exploited?
There is no known exploitation of CVE-2026-30656 in the wild and no public exploit code.
Sources
Also known as AZL-85530, DEBIAN-CVE-2026-30656, GHSA-hgfx-pj29-fw66, MGASA-2026-0564, OESA-2026-2095, OESA-2026-2096 and 5 more.