{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68145","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-30T09:28:09.371Z","datePublished":"2026-08-10T11:59:09.721Z","dateUpdated":"2026-08-23T12:45:56.875Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-23T12:45:56.875Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niomap: fix out-of-bounds bitmap_set() with zero-length range\n\nifs_set_range_dirty() and ifs_set_range_uptodate() compute last_blk\nas (off + len - 1) >> i_blkbits.  When off is 0 and len is 0, the\nunsigned subtraction underflows to SIZE_MAX, producing a huge\nlast_blk and nr_blks value that causes bitmap_set() to write far\nbeyond the ifs->state allocation.\n\nRegarding ifs_set_range_uptodate(), it is temporarily safe because len\ncannot be passed in as 0. However, for ifs_set_range_dirty() this is\nreachable from __iomap_write_end(): when copy_folio_from_iter_atomic()\nreturns 0 (e.g. user buffer fault) and the folio is already uptodate,\nthe guard at the top of __iomap_write_end() does not trigger because\n!folio_test_uptodate() is false, and iomap_set_range_dirty() is called\nwith copied == 0.\n\nAdd a !len guard to both functions before the computation, so that a\nzero-length range is a no-op."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached via the buffered write() path through iomap_file_buffered_write() when copy_folio_from_iter_atomic() returns 0; NFS/ksmbd server writes use kernel bvec iterators and do not hit this user-buffer fault path.\nAC:L - An attacker can reliably trigger copied==0 by racing munmap/remap against write() on an already-uptodate folio (TOCTOU after fault_in_iov_iter_readable), controlling both sides of the race on systems where folio size exceeds filesystem block size.\nPR:L - Only standard local write permission to a file on an iomap-backed filesystem (XFS, GFS2, FUSE writeback-cache, zonefs, NTFS) is required; no CAP_SYS_ADMIN or other elevated capability is needed beyond creating/triggering writes to attacker-writable files.\nUI:N - Exploitation requires only the attacker's own write operations to a writable file; no action by another user or administrator (such as mounting a filesystem or opening a file on the victim's behalf) is needed.\nS:U - Successful exploitation corrupts host kernel heap memory and enables local privilege escalation within the same kernel security domain; it does not inherently cross VM, container, or IOMMU boundaries.\nC:H - ifs_set_range_dirty() with len==0 underflows to SIZE_MAX and bitmap_set() writes far beyond the small kzalloc_flex(ifs->state) allocation, corrupting adjacent kmalloc objects in ways that can be leveraged for arbitrary kernel memory disclosure.\nI:H - The out-of-bounds bitmap_set() is a large heap overwrite primitive adjacent to the iomap_folio_state allocation, enabling control of kernel data structures and arbitrary code execution via standard heap exploitation techniques.\nA:H - The massive out-of-bounds write can immediately corrupt critical kernel heap metadata or adjacent objects, causing kernel oops/panic or unrecoverable memory corruption even before full exploitation is attempted."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/iomap/buffered-io.c"],"versions":[{"version":"4ce02c67972211be488408c275c8fbf19faf29b3","lessThan":"48829622212f6b8f49155889aecc818ba28ba680","status":"affected","versionType":"git"},{"version":"4ce02c67972211be488408c275c8fbf19faf29b3","lessThan":"fb4fad9105c88b1d82f1b3c39e3b6abea8249af6","status":"affected","versionType":"git"},{"version":"4ce02c67972211be488408c275c8fbf19faf29b3","lessThan":"7037e7bdcd26f46c080b8ce307dee5cb471c4b7c","status":"affected","versionType":"git"},{"version":"4ce02c67972211be488408c275c8fbf19faf29b3","lessThan":"c5b6a48a8a716a7730e39af1cad083dc4ec955ce","status":"affected","versionType":"git"},{"version":"4ce02c67972211be488408c275c8fbf19faf29b3","lessThan":"9c7d8f7c8994c790fca501dc45ce66e7356cbe05","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/iomap/buffered-io.c"],"versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","status":"unaffected","versionType":"semver"},{"version":"6.6.153","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.6.153"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.12.101"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.18.42"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/48829622212f6b8f49155889aecc818ba28ba680"},{"url":"https://git.kernel.org/stable/c/fb4fad9105c88b1d82f1b3c39e3b6abea8249af6"},{"url":"https://git.kernel.org/stable/c/7037e7bdcd26f46c080b8ce307dee5cb471c4b7c"},{"url":"https://git.kernel.org/stable/c/c5b6a48a8a716a7730e39af1cad083dc4ec955ce"},{"url":"https://git.kernel.org/stable/c/9c7d8f7c8994c790fca501dc45ce66e7356cbe05"}],"title":"iomap: fix out-of-bounds bitmap_set() with zero-length range","x_generator":{"engine":"bippy-1.2.0"}}}}