CVE-2026-30656: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-30656 is a NULL pointer dereference vulnerability (CWE-476) in fio (Flexible I/O Tester) v3.41 that causes a segmentation fault and process crash when parsing job files containing the fdp_pli option without an argument. The vulnerability was discovered via AFL++ fuzzing and reported on February 8, 2026, with public disclosure on April 16, 2026. It affects fio v3.41 up to commit a8ab726842f4140dfcdb4240138f1abba9b54c05, with a fix available in commit 9387e61b5fcfbce1e4ed29b0cd19890a37ba1766. The CVSS v3.1 base score is 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a missing NULL pointer validation in the str_fdp_pli_cb() callback function in options.c. When a fio job file specifies the fdp_pli option without a value, the parser passes input = NULL to the callback, which then calls strdup(input) without first checking whether the pointer is valid, resulting in a segmentation fault. The suggested fix is to add a guard at the start of the callback: if (!input) return 1; before the strdup() call. The vulnerability was discovered through AFL++ fuzzing with a minimal reproducer consisting of a job file containing only [write-heavy] and fdp_pli with no assigned value (GitHub Issue, Researcher Gist).

Successful exploitation results in a denial-of-service condition — specifically a segmentation fault that crashes the fio process. There is no impact on confidentiality or data integrity. The primary risk is disruption of I/O testing workflows; in environments where fio operates as a backend service processing untrusted job configuration files, an attacker could repeatedly crash the service to cause sustained unavailability (GitHub Issue, Red Hat Bugzilla).

No public proof-of-concept exploit code has been released beyond the minimal reproducer (a crafted job file) documented in the original bug report. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.06–0.086%, indicating a low probability of exploitation in the near term (GitHub Advisory, Feedly).

1. Identify target: Locate a system or service running fio v3.41 that accepts or processes externally supplied job configuration files (e.g., a storage benchmarking service or CI/CD pipeline using fio).
2. Craft malicious job file: Create a minimal fio job file (crash.fio) with the following content:

[write-heavy]
fdp_pli

The key is specifying fdp_pli without any value, which causes the parser to pass NULL to the callback. 3. Submit the job file: Supply the crafted crash.fio to the fio process, either directly via CLI (./fio crash.fio) or through whatever interface the target service uses to accept job configurations. 4. Trigger crash: The str_fdp_pli_cb() function receives a NULL input pointer and calls strdup(NULL), causing a segmentation fault and immediate process termination, achieving denial of service (GitHub Issue, Researcher Gist).

• Logs: Kernel or system logs (e.g., /var/log/syslog, dmesg) showing segmentation fault entries for the fio process; crash reports referencing str_fdp_pli_cb in the backtrace.
• Process: Unexpected termination of fio processes with signal 11 (SIGSEGV); core dump files generated in the working directory of the fio process.
• File System: Presence of crafted job files containing fdp_pli without an assigned value in directories monitored by fio services; core dump files (e.g., core, core.<pid>) in fio working directories.
• Application: Repeated fio process restarts in automated or service contexts; monitoring alerts for fio process crashes (GitHub Issue).

Upgrade fio to a version that includes the fix introduced in commit 9387e61b5fcfbce1e4ed29b0cd19890a37ba1766, which adds a NULL check at the start of str_fdp_pli_cb(). As a workaround where upgrading is not immediately possible, restrict fio from processing untrusted or externally supplied job configuration files, and validate all job file inputs before passing them to fio. Organizations using fio as a backend service should implement input sanitization to reject job files containing fdp_pli without an argument (GitHub Advisory, Researcher Gist).

Red Hat tracked the issue via their security response process (Bugzilla bug 2458951), classifying it as medium severity. The vulnerability was discovered and responsibly reported by researcher "Criticayon" via AFL++ fuzzing, with a detailed write-up and minimal reproducer published publicly. No significant broader media coverage or notable community debate has been observed beyond the upstream GitHub issue and advisory (Red Hat Bugzilla, GitHub Issue).