{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "a9d573ee88af980f14fdadb5c12bbf6a195fb3f1"
            },
            {
              "fixed": "1ad453817a4077230d1ba88eb0868f05f824449a"
            },
            {
              "fixed": "2eea7f44b9c8b42fd7d3a1a87c06a7cd1b99c327"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.0.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53165.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\niomap: avoid potential null folio-\u003emapping deref during error reporting\n\nWhen a buffered read fails, iomap_finish_folio_read() reports the error\nwith fserror_report_io(folio-\u003emapping-\u003ehost, ...). This is called after\nifs-\u003eread_bytes_pending has been decremented by the bytes attempted to\nbe read.\n\nFor a folio split across multiple read completions, the folio is only\nguaranteed to stay locked while read_bytes_pending \u003e 0. Once\niomap_finish_folio_read() decrements read_bytes_pending, another\nin-flight read can complete and end the read on the folio, which unlocks\nit. This allows truncate logic to run and detach the folio (set\nfolio-\u003emapping to NULL). The error reporting path then can dereference a\nNULL folio-\u003emapping. As reported by Sam Sun, this is the race that can\noccur:\n\nCPU0: failed completion      CPU1: final completion     CPU2: truncate\n-----------------------      ----------------------     --------------\nread_bytes_pending -= len\nfinished = false\n/* preempted before\n   fserror_report_io() */\n\t\t\t     read_bytes_pending -= len\n\t\t\t     finished = true\n\t\t\t     folio_end_read()\n\t\t\t\t\t\t\ttruncate clears\n\t\t\t\t\t\t\tfolio-\u003emapping\nfserror_report_io(\n  folio-\u003emapping-\u003ehost, ...)\n\t      ^ NULL deref\n\nFix this by reporting the error first before decrementing\nifs-\u003eread_bytes_pending.",
  "id": "CVE-2026-53165",
  "modified": "2026-07-09T03:52:15.617990382Z",
  "published": "2026-06-25T08:38:45.445Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1ad453817a4077230d1ba88eb0868f05f824449a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2eea7f44b9c8b42fd7d3a1a87c06a7cd1b99c327"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53165.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53165"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.7.5",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "iomap: avoid potential null folio-\u003emapping deref during error reporting"
}