CVE-2026-80720 iomap: add a separate bio_set for iomap_split_ioend
A deadlock in the Linux kernel's iomap subsystem can cause a denial of service when biosets are exhausted during I/O splitting.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80720?
CVE-2026-80720 is a high-severity denial of service vulnerability in Linux, published on 28 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
iomap: add a separate bio_set for iomap_split_ioend
iomap_split_ioend can split bios that already come from iomap_ioend_bioset and thus deadlock when the bioset is exhausted.
Add a separate bio_set to avoid this deadlock.
Christian Brauner <[email protected]> says: Mark iomap_ioend_split_bioset static as it is only used in ioend.c, fixing the sparse warning reported by the kernel test robot.
Which versions are affected by CVE-2026-80720?
How do I fix CVE-2026-80720?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-80720 being exploited?
There is no known exploitation of CVE-2026-80720 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-80720, DEBIAN-CVE-2026-80720, GHSA-88fc-rw34-hx7h, UBUNTU-CVE-2026-80720.