CVE-2026-74392

In the Linux kernel, the following vulnerability has been resolved:

dm: limit target bio polling to one shot

dmpollbio() is the ->pollbio() callback for a stacked dm device. The caller only knows about the dm queue, so it may decide to do a spinning poll if it thinks a single queue is being polled. Passing those flags unchanged to the mapped clone lets blkmqpoll() spin on a target queue from inside dmpoll_bio().

With io_uring IOPOLL on a dm-stripe target this can keep a task in

dmpollbio() -> biopoll() -> blkmq_poll()

long enough to trigger an RCU CPU stall, before iouring gets back to ioiopollcheck() and its needresched() check.

Keep dm's ->pollbio() bounded by forcing one-shot polling for target bios. The caller can invoke dmpoll_bio() again if it wants to keep polling, and it also gets a chance to reap completions or reschedule between passes.