{"id":"CVE-2026-53165","summary":"iomap: avoid potential null folio-\u003emapping deref during error reporting","details":"In the Linux kernel, the following vulnerability has been resolved:\n\niomap: avoid potential null folio-\u003emapping deref during error reporting\n\nWhen a buffered read fails, iomap_finish_folio_read() reports the error\nwith fserror_report_io(folio-\u003emapping-\u003ehost, ...). This is called after\nifs-\u003eread_bytes_pending has been decremented by the bytes attempted to\nbe read.\n\nFor a folio split across multiple read completions, the folio is only\nguaranteed to stay locked while read_bytes_pending \u003e 0. Once\niomap_finish_folio_read() decrements read_bytes_pending, another\nin-flight read can complete and end the read on the folio, which unlocks\nit. This allows truncate logic to run and detach the folio (set\nfolio-\u003emapping to NULL). The error reporting path then can dereference a\nNULL folio-\u003emapping. As reported by Sam Sun, this is the race that can\noccur:\n\nCPU0: failed completion      CPU1: final completion     CPU2: truncate\n-----------------------      ----------------------     --------------\nread_bytes_pending -= len\nfinished = false\n/* preempted before\n   fserror_report_io() */\n\t\t\t     read_bytes_pending -= len\n\t\t\t     finished = true\n\t\t\t     folio_end_read()\n\t\t\t\t\t\t\ttruncate clears\n\t\t\t\t\t\t\tfolio-\u003emapping\nfserror_report_io(\n  folio-\u003emapping-\u003ehost, ...)\n\t      ^ NULL deref\n\nFix this by reporting the error first before decrementing\nifs-\u003eread_bytes_pending.","modified":"2026-07-09T03:52:15.617990382Z","published":"2026-06-25T08:38:45.445Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53165.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/1ad453817a4077230d1ba88eb0868f05f824449a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/2eea7f44b9c8b42fd7d3a1a87c06a7cd1b99c327"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53165.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53165"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"a9d573ee88af980f14fdadb5c12bbf6a195fb3f1"},{"fixed":"1ad453817a4077230d1ba88eb0868f05f824449a"},{"fixed":"2eea7f44b9c8b42fd7d3a1a87c06a7cd1b99c327"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53165.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.13"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53165.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}