CVE-2026-80720: 
Linux Debian Analyse et atténuation des vulnérabilités

CVE-2026-80720 is a deadlock vulnerability in the Linux kernel's iomap subsystem, specifically in the iomap_split_ioend function. When splitting BIOs (block I/O requests) that already originate from iomap_ioend_bioset, the function can exhaust the bioset and cause a deadlock. The vulnerability affects Linux kernel version 6.15 through commits prior to the fixes, with patched versions available at 6.18.44, 7.1.8, and 7.2. It was published on August 28, 2026, with a CVSS category estimate of Medium and an EPSS score of 0.0 (GitHub Advisory, Feedly).

The root cause is a resource exhaustion deadlock (related to CWE-833: Deadlock) in the Linux kernel's iomap I/O completion path. The iomap_split_ioend function allocates new BIOs from iomap_ioend_bioset to split existing ioends; however, since the BIOs being split already originate from the same bioset, concurrent allocation attempts can exhaust the pool and cause all waiters to deadlock. The fix introduces a separate iomap_ioend_split_bioset (marked static as it is only used in ioend.c) to decouple split allocations from the primary bioset, eliminating the circular resource dependency (GitHub Advisory, Kernel Patch).

Successful triggering of this vulnerability causes the affected Linux system to hang during I/O operations, particularly under memory pressure when the bioset is exhausted. The primary impact is an availability denial — the system or specific I/O paths become unresponsive, potentially requiring a reboot. There is no known confidentiality or integrity impact, and the vulnerability does not enable code execution or privilege escalation (GitHub Advisory, Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2026-80720. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Triggering the deadlock likely requires specific I/O workloads under memory pressure on an affected kernel version (GitHub Advisory).

The Linux kernel maintainers have released patches addressing this vulnerability. Users should upgrade to kernel version 6.18.44, 7.1.8, or 7.2 (or later), which include the fix commits cfc686a1174aa904dcad9b9a7c5e46b484d27e4e, 4a869be56e9f6ce7462abcf324ebdefc5de051be, and c679ce3be6cb63763d68ab9b5d9d73ddc0a40762 respectively. No configuration-based workaround is documented; upgrading to a patched kernel release is the recommended remediation (GitHub Advisory, Kernel Patch).