MGASA-2026-0564: Updated fio package fixes a security vulnerability
A NULL pointer dereference vulnerability exists in fio (Flexible I/O Tester) v3.41 when parsing job files containing the fdppli option. The callback function strfdpplicb() does not validate the input pointer and calls strdup() on a NULL value when the option is specified without an argument. This results in a segmentation fault and process crash. (CVE-2026-30656)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mageia/fioto a version that resolves this vulnerability.Fixed in 3.41-4.2.mga10
Event History
Frequently Asked Questions
What input is required to trigger the crash?
fio must parse a job file that specifies the fdp_pli option without an argument. In that condition, the str_fdp_pli_cb() callback passes a NULL value to strdup(), causing a segmentation fault.
What is the practical impact of successful exploitation?
The described impact is a fio process crash due to a NULL pointer dereference. The provided information does not describe code execution, privilege escalation, or impact beyond denial of service.
Who is exposed to this issue?
Systems using the affected fio version are exposed when fio processes job files whose contents may include an fdp_pli option without a value. This is most relevant where untrusted or insufficiently reviewed job files can be supplied to fio.