CVE-2026-30656 Details
Description
A NULL pointer dereference vulnerability exists in fio (Flexible I/O Tester) v3.41 when parsing job files containing the fdp_pli option. The callback function str_fdp_pli_cb() does not validate the input pointer and calls strdup() on a NULL value when the option is specified without an argument. This results in a segmentation fault and process crash.
A NULL pointer dereference vulnerability has been identified in fio (Flexible I/O Tester) version 3.41. The issue arises in the job file parser when the fdp_pli option is specified without an accompanying value. The parser fails to validate the input, leading the callback function str_fdp_pli_cb() to call strdup() with a NULL pointer. This oversight causes a segmentation fault, crashing the process. While this vulnerability does not pose a security risk during normal command-line interface (CLI) usage, it could result in a denial-of-service condition if fio is used as a backend service that processes untrusted job files.
Users can upgrade to fio version 3.41 (commit 9387e61b5fcfbce1e4ed29b0cd19890a37ba1766) or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/Criticayon/eb5e69163bfa4ce684e62ed5c939b76e | [email protected] | |
| https://github.com/axboe/fio/issues/2055 | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | CISA-ADP |
Affected Products
No affected product data is available for this CVE.
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 16, 2026 | CVE Modified | CISA-ADP |
| Apr 16, 2026 | New CVE Received | [email protected] |