CVE-2026-53165: Linux Kernel iomap Null Pointer Dereference Denial of Service

Technical summary

CVE-2026-53165 is a null pointer dereference vulnerability in the Linux kernel's iomap subsystem, specifically in iomap_finish_folio_read(). The issue arises from a race condition where error reporting on folio->mapping->host occurs after decrementing ifs->read_bytes_pending. For folios spanning multiple read completions, the folio remains locked only while read_bytes_pending > 0. Once this counter is decremented, concurrent read completions may unlock the folio, allowing truncate logic to execute and set folio->mapping to NULL before the error reporting code dereferences it. The fix involves reporting the error before decrementing the pending bytes counter, ensuring the folio mapping remains valid during the critical section.

Business impact

Exploitation of this vulnerability can cause kernel panic and system downtime, affecting all services dependent on the compromised system. For organizations running database servers, file servers, or other I/O-intensive workloads on Linux, this crash can result in service interruptions and potential data access delays. Cloud providers and hosting platforms are particularly exposed, as workload density increases the likelihood of triggering the race condition.

Affected systems

The Linux kernel is affected. Organizations running Linux distributions across servers, cloud instances, containers, and embedded systems should assess their kernel versions. While the specific patch version is not provided in vendor advisories cited here, the vulnerability affects the iomap buffered read path, which is present across all modern Linux kernel distributions. Verify your kernel version against official Linux vendor security advisories and the upstream kernel.org advisory.

Exploitability

The vulnerability requires network access and leverages a timing-dependent race condition. An attacker cannot guarantee reproduction on a single attempt but can increase likelihood through crafted I/O patterns that trigger concurrent reads on the same folio followed by truncate operations. No known public exploit code exists, and the CVSS score of 7.5 (HIGH) reflects the availability impact despite requiring specific conditions. Exploitation does not grant code execution or privilege escalation—it causes denial of service through kernel crash.

Remediation

Apply the upstream Linux kernel patch that addresses iomap error reporting sequencing. The fix ensures error reporting occurs before read_bytes_pending is decremented, eliminating the window for folio->mapping to be cleared. Affected systems should prioritize kernel updates released after the publication date of June 25, 2026. Organizations should coordinate patching with change management procedures, accounting for system restart requirements.

Patch guidance

Obtain kernel updates from your Linux distribution's official security repository (Red Hat, Canonical, SUSE, etc.) or from kernel.org. The patch involves reordering the error reporting logic in iomap_finish_folio_read() to execute before the read_bytes_pending decrement. Verify against the vendor's published advisory for specific kernel versions and patch levels. Test patches in a staging environment before production deployment, particularly for systems with high I/O concurrency.

Detection guidance

Monitor system logs for kernel panic messages or oops dumps referencing iomap_finish_folio_read() or null pointer dereferences in the I/O mapping subsystem. Unexpected system restarts or hung I/O processes may indicate exploitation. Systems under sustained network I/O load with concurrent reads on large files are at higher risk. Use kernel crash dump analysis tools (kdump, kexec) to capture and review panic details if incidents occur.

Why prioritize this

This vulnerability rates HIGH severity (CVSS 7.5) and should be prioritized for patch deployment within 30 days, particularly for production systems serving I/O-intensive workloads (databases, file servers, NFS). While not currently exploited in the wild, the low complexity of exploitation via network-accessible I/O patterns and the guaranteed availability impact of kernel panic justify rapid remediation. Systems in high-concurrency environments face increased risk.

Risk score, explained

The CVSS 7.5 score reflects: (1) Network-accessible attack vector requiring no user interaction or privileges; (2) High availability impact from guaranteed denial of service via kernel crash; (3) No confidentiality or integrity impact; (4) Attack complexity is low due to timing-dependent nature being reliably triggered under typical I/O workloads. The vulnerability is not listed in the Known Exploited Vulnerabilities catalog, reducing urgency slightly but not eliminating the need for timely patching.

Frequently asked questions