Advisories » MGASA-2026-0564

Updated fio package fixes a security vulnerability

Publication date: 28 Oct 2026
Modification date: 28 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-30656

Description

A NULL pointer dereference vulnerability exists in fio (Flexible I/O
Tester) v3.41 when parsing job files containing the fdp_pli option. The
callback function str_fdp_pli_cb() does not validate the input pointer
and calls strdup() on a NULL value when the option is specified without
an argument. This results in a segmentation fault and process crash.
(CVE-2026-30656)
                

References

• https://bugs.mageia.org/show_bug.cgi?id=36480
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/GV237ENVXHS5VMJOZ2CB5ESWMM43O5X6/
• https://www.cve.org/CVERecord?id=CVE-2026-30656

SRPMS

10/core

• fio-3.41-4.2.mga10