A vulnerability in the Linux kernel iomap subsystem allows unauthenticated attackers to cause a system deadlock, leading to a denial of service.

This is a resource exhaustion flaw within the iomap_split_ioend function. The issue arises because the system utilizes the same bio_set for split operations, which can be exhausted during high I/O load, resulting in a kernel-level deadlock that requires an unauthenticated attacker to trigger via specific I/O patterns.

Successful exploitation of this vulnerability results in a denial of service, as the affected system will enter a deadlocked state requiring a hard reboot. Given the CVSS score of 7.5, this high severity vulnerability poses a significant risk to system availability, potentially disrupting critical business operations and services that rely on high-performance storage I/O.

Immediate Action: Update the Linux kernel to version 6.18.44, 7.1.8, or later, as these releases include the dedicated bio_set implementation required to prevent the deadlock.

Proactive Monitoring: Monitor system logs for kernel panic messages or I/O subsystem hangs that may indicate an attempt to trigger this deadlock condition.

Compensating Controls: While no direct virtual patch exists, administrators should monitor storage I/O performance and ensure that system resources are not being intentionally stressed by untrusted users or processes.

Public Exploit Available: Unknown

This vulnerability represents a significant stability risk for systems utilizing the iomap interface. Organizations should prioritize updating their Linux kernels to the specified fixed versions to ensure system uptime and prevent potential denial of service attacks. Immediate patching is the only effective way to eliminate the underlying deadlock condition.