Mass segfaults on a ZFS host: not bad RAM, an unsigned underflow in zfs_fillpage()

In OpenZFS before versions 2.4.4 and 2.3.9, the zfs_fillpage() function computed read length as i_size - io_off using unsigned types. When a file was truncated during an mmap read, the difference underflowed to nearly 2⁶⁴, and dmu_read() zeroed physical memory beyond the requested page, causing random processes to crash with segfaults. Fixed in OpenZFS 2.4.4 and 2.3.9 released on August 21, 2026.

• Cause: unsigned underflow in zfs_fillpage() during mmap read and file truncation race
• Fixed in OpenZFS 2.4.4 and 2.3.9, released August 21, 2026
• Version 2.2.11 of the same date does not fix the bug
• Default systemd CrashAction=freeze turns the crash into multi-hour downtime