CVE-2026-89578

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

dm-io: clone the source bio instead of copying its biovec

For DM_IO_BIO requests, do_region() built each destination bio by walking

the source bio's biovec and re-adding the pages one at a time, tracking

the remaining transfer in sectors. The vector lengths are byte granular

and need not be sector aligned (e.g. a misaligned O_DIRECT buffer split

across pages), so the sector-based accounting could lose a sub-sector

fragment: to_sector() truncated the remainder and the outer loop spun

forever submitting empty bios, hanging the I/O.

There is no need to rebuild the biovec at all. The destination reads into

(or writes from) exactly the same pages as the source bio, so the bio can

simply clone the source's biovec with bio_alloc_clone() and remap it to

the target device. The clone inherits the source's iterator and alignment,

and the block layer splits it to the target's limits on submission, so the

whole region maps to a

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References