Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
fio: Data Corruption and Crash When Parsing Malicious Job Files
published 6 months ago
Summary
A security update is available for fio, a tool used to test disk performance. If maliciously crafted job files are used, fio can crash or become unresponsive, potentially causing data corruption or disrupting system operations. Update to the latest version of fio to address this issue.
What to do
- Update openeuler fio to version 3.34-6.oe2403.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| openEuler:24.03-LTS | openeuler | fio |
< 3.34-6.oe2403 Fix: upgrade to 3.34-6.oe2403
|
Original advisory text
fio security update
fio is a tool used to spawn many threads or processes that perform a specific type of io operation specified by the user.It accepts many global parameters inherited by threads.Its common method is to simulate jobs that match the specified io load.
Security Fix(es):
A NULL pointer dereference vulnerability exists in fio (Flexible I/O Tester) v3.41 when parsing job files containing the fdp_pli option. The callback function str_fdp_pli_cb() does not validate the input pointer and calls strdup() on a NULL value when the option is specified without an argument. This results in a segmentation fault and process crash.(CVE-2026-30656)
Security Fix(es):
A NULL pointer dereference vulnerability exists in fio (Flexible I/O Tester) v3.41 when parsing job files containing the fdp_pli option. The callback function str_fdp_pli_cb() does not validate the input pointer and calls strdup() on a NULL value when the option is specified without an argument. This results in a segmentation fault and process crash.(CVE-2026-30656)
References
- https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-30656 Vendor Advisory
Timeline
Published25 Apr 2026
Updated25 Apr 2026
First seen25 Apr 2026
Sources
OESA-2026-2096 · OSV
Track software like this
Free during beta