CVE-2026-90384: iomap: release the folio batch on iomap callback failures

CVE-2026-90384: iomap: release the folio batch on iomap callback failures

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

iomap: release the folio batch on iomap callback failures

A sashiko review of an unrelated patch points out that the folio
batch mechanism used for iomap zero range fails to release the batch
in a couple error scenarios. If either calls to ->iomap_end() or
->iomap_begin() fail, the direct return paths bypass the batch
cleanup.

The ->iomap_end() case is not a practical issue at the moment
because there is no user of the mechanism that returns an error from
this path. The ->iomap_begin() case is theoretically possible
because XFS can invoke the fill helper and error out at various
points thereafter. This subtly complicates things because XFS does
not transfer iomap_flags to the iomap data structure in the error
path.

To deal with both of these issues, first make sure to invoke the
cleanup helper in the error path for either fs callback. Second,
update the helper to clear the flag unconditionally and release the
batch so long as it is populated. This more clearly delineates the
purpose of the flag to control the I/O path and not necessarily the
status of the fbatch, so add a comment around this as well.

The Linux kernel CVE team has assigned CVE-2026-90384 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.19 with commit 395ed1ef0012e1bb1e4050e84ba0173b3623112a and fixed in 7.2.6 with commit 34470cc3a8e66751030d7b777dd18d9f2acb48e8
	Issue introduced in 6.19 with commit 395ed1ef0012e1bb1e4050e84ba0173b3623112a and fixed in 7.3-rc1 with commit 31e3d833d522746a93d135e8b465d16f8ad33453

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-90384
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/iomap/iter.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/34470cc3a8e66751030d7b777dd18d9f2acb48e8
	https://git.kernel.org/stable/c/31e3d833d522746a93d135e8b465d16f8ad33453