CVE-2026-68145
Received Received - Intake

Out-of-Bounds Write in Linux Kernel iomap

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: iomap: fix out-of-bounds bitmap_set() with zero-length range ifs_set_range_dirty() and ifs_set_range_uptodate() compute last_blk as (off + len - 1) >> i_blkbits. When off is 0 and len is 0, the unsigned subtraction underflows to SIZE_MAX, producing a huge last_blk and nr_blks value that causes bitmap_set() to write far beyond the ifs->state allocation. Regarding ifs_set_range_uptodate(), it is temporarily safe because len cannot be passed in as 0. However, for ifs_set_range_dirty() this is reachable from __iomap_write_end(): when copy_folio_from_iter_atomic() returns 0 (e.g. user buffer fault) and the folio is already uptodate, the guard at the top of __iomap_write_end() does not trigger because !folio_test_uptodate() is false, and iomap_set_range_dirty() is called with copied == 0. Add a !len guard to both functions before the computation, so that a zero-length range is a no-op.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68145
EUVD
EUVD-2026-55529

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the iomap subsystem where functions compute incorrect block ranges when handling zero-length operations. Specifically, ifs_set_range_dirty() and ifs_set_range_uptodate() calculate last_blk as (off + len - 1) >> i_blkbits. When off is 0 and len is 0, this causes an underflow, leading to a massive last_blk and nr_blks value. This results in bitmap_set() writing beyond the allocated memory for ifs->state, potentially causing memory corruption or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's iomap subsystem and may not have direct network detection methods. Check kernel logs for errors related to filesystem operations or bitmap_set() out-of-bounds writes. Use commands like dmesg | grep -i iomap or journalctl -k | grep -i iomap to inspect kernel messages.

Impact Analysis

This vulnerability could lead to system instability, crashes, or potential privilege escalation if exploited. It may cause memory corruption, data corruption, or denial-of-service conditions on affected Linux systems. Users running vulnerable kernel versions could experience system failures or security breaches.

Mitigation Strategies

Update your Linux kernel to the latest patched version. If immediate patching is not possible, avoid triggering the vulnerable code paths by ensuring filesystem operations do not involve zero-length ranges. Monitor system stability and filesystem integrity closely.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68145. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart