SB2026081608 - Improper resource shutdown or release in Linux kernel iomap

Description

This security bulletin contains information about 1 vulnerability.

1) Improper resource shutdown or release (CVE-ID: CVE-2026-72370)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in iomap direct I/O handling in fs/iomap/direct-io.c when processing atomic direct I/O requests with a size mismatch that results in a short bio. A local user can trigger the error path with a short bio to cause a denial of service.

The issue occurs because pages already attached to the bio are not released before the bio reference is dropped on the affected error path.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/27ddd3442fc6f698fb8577c7cfb243ddd81ea8c0
• https://git.kernel.org/stable/c/681e452683b69a8e1a571cba0f238f8ceacf55d2