Linux kernel iomap: ioend splitting draws from its own exhausted bio_set and deadlocks writeback

Impact

iomap_split_ioend() split bios that were themselves allocated from iomap_ioend_bioset, so under mempool exhaustion the split waits on a reserve that only completing I/O can replenish - a classic writeback deadlock. When it hits, writeback on an iomap filesystem (XFS and friends, particularly on zoned or split-prone devices) stops making progress and the tasks are stuck in uninterruptible sleep; the node cannot be drained gracefully and needs a reboot. On a GPU node that means killing whatever training or serving work holds the GPUs, since the filesystem hang usually takes the checkpoint and dataset paths with it. The kernel CNA scored this network-reachable, but the practical trigger is memory pressure during heavy writeback rather than a remote packet - treat it as an availability bug on busy storage-heavy nodes.

Who can reach it

Local workload generating enough concurrent writeback to exhaust the iomap ioend bioset; no authentication boundary is crossed, and any tenant able to write heavily to an affected filesystem can create the pressure.

What to do

Update to a stable kernel carrying the linked commits, which add a dedicated iomap_ioend_split_bioset, and reboot each affected node. There is no runtime tunable that removes the shared-mempool dependency; reducing writeback concurrency only lowers the odds. The record names no fixed release beyond the stable commits.

References

Related entries

• Linux kernel crypto/krb5: derived Kerberos keys left in freed slab memoryCVE-2026-80924 · Linux kernel crypto/krb5 (derived key buffers for RPCSEC_GSS)High
• Linux kernel ntb_transport: oversized transmit buffers leak skbs until the host runs out of memoryCVE-2026-80987 · Linux kernel NTB ntb_transport / ntb_netdev (oversized TX buffer skb leak)High
• OpenSSL 4.0: use-after-free in the X.509 extension cache crashes multi-threaded TLS peersCVE-2026-84783 · OpenSSL 4.0 X.509 extension cache (concurrent X509 use)High
• OpenSSL QUIC: unthrottled RETIRE_CONNECTION_ID backlog lets a peer force ~400MB of allocationCVE-2026-84784 · OpenSSL QUIC stack (NEW_CONNECTION_ID / RETIRE_CONNECTION_ID handling)High
• Linux kernel SUNRPC: gssx decode error paths NULL-deref and leak group_info on the NFS serverCVE-2026-89544 · Linux kernel nfsd/SUNRPC gssx option-array decoder (gss-proxy upcall)High
• Linux kernel nfsd: transports routed to threadless service pools hang the connection indefinitelyCVE-2026-89549 · Linux kernel SUNRPC svc_pool_for_cpu() (nfsd pool-to-CPU routing)High