CVE-2026-89770 iomap: don't free integrity payload that doesn't exist
A local attacker can cause a kernel crash via NULL pointer dereference in iomap when integrity payload is missing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89770?
CVE-2026-89770 is a vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
iomap: don't free integrity payload that doesn't exist
fs_bio_integrity_alloc might not allocate a bio integrity payload if PI verification is disabled on the block device. Check for that case before calling fs_bio_integrity_free in iomap_bio_read_folio_range_sync to avoid a NULL pointer dereferences.
Make the branch cover the PI verification as well - while fs_bio_integrity_verify works without an integrity payload, it requires one to actually do useful work.
Which versions are affected by CVE-2026-89770?
How do I fix CVE-2026-89770?
Apply the vendor's patch.
Is CVE-2026-89770 being exploited?
There is no known exploitation of CVE-2026-89770 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-89770, GHSA-p8q7-qqp3-r9v3, UBUNTU-CVE-2026-89770.