CVE-2026-72367

Received Received - Intake

Buffer Overflow in Linux Kernel iomap

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: iomap: guard io_size EOF trim against concurrent truncate underflow iomap: fix zero padding data issue in concurrent append writes changed ioend accounting so that io_size tracks only valid data within EOF. This trims io_size when a writeback range extends past end_pos: ioend->io_size += map_len; if (ioend->io_offset + ioend->io_size > end_pos) ioend->io_size = end_pos - ioend->io_offset; However, if end_pos ends up below ioend->io_offset, the subtraction becomes negative and is stored in size_t io_size, causing an unsigned wrap to a huge value. This can happen when writeback continues past byte-level EOF up to a block-aligned range, or when a concurrent truncate shrinks the file after end_pos was sampled in iomap_writeback_handle_eof(). A wrapped io_size can mislead append detection and corrupt completion-time size handling, since filesystem end_io paths consume io_size for decisions such as on-disk EOF updates and unwritten/COW completion ranges. Fix this by clamping io_size to zero when EOF has moved to or before the ioend start offset. This preserves the original intent of trimming io_size to valid in-EOF data while avoiding the underflow.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72367

EUVD

EUVD-2026-59266

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves incorrect handling of file write operations when a file is truncated or extended concurrently. The issue occurs when the system tries to trim write data to the end of a file but miscalculates the valid data size due to a race condition. This can lead to corrupted file size tracking and potential data corruption.

Detection Guidance

This vulnerability is specific to the Linux kernel's iomap subsystem and requires kernel-level detection. There are no direct network or system commands to detect it as it involves internal filesystem writeback handling. Monitoring kernel logs for filesystem errors or crashes related to iomap operations may indicate exploitation or issues.

Impact Analysis

This vulnerability could cause filesystem corruption, leading to data loss or incorrect file sizes. Applications relying on accurate file sizes may malfunction, and filesystem operations could fail unexpectedly. Users might experience system crashes or data integrity issues if the kernel incorrectly handles file writes.

Compliance Impact

This vulnerability affects data integrity in the Linux kernel's file system handling, which could lead to incorrect file size reporting and potential data corruption during concurrent write and truncate operations. For compliance standards like GDPR and HIPAA, which require accurate data handling and integrity, this could result in violations if the vulnerability causes unauthorized data access, modification, or loss.

Mitigation Strategies

Update your Linux kernel to the latest patched version to resolve this vulnerability. Monitor filesystem writeback operations and truncate events for unexpected behavior. Ensure no concurrent operations are modifying file sizes during writeback processes.

Hi! I’m here to help you understand CVE-2026-72367. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70