CVE-2026-68145

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iomap: fix out-of-bounds bitmap_set() with zero-length range

ifs_set_range_dirty() and ifs_set_range_uptodate() compute last_blk

as (off + len - 1) >> i_blkbits. When off is 0 and len is 0, the

unsigned subtraction underflows to SIZE_MAX, producing a huge

last_blk and nr_blks value that causes bitmap_set() to write far

beyond the ifs->state allocation.

Regarding ifs_set_range_uptodate(), it is temporarily safe because len

cannot be passed in as 0. However, for ifs_set_range_dirty() this is

reachable from __iomap_write_end(): when copy_folio_from_iter_atomic()

returns 0 (e.g. user buffer fault) and the folio is already uptodate,

the guard at the top of __iomap_write_end() does not trigger because

!folio_test_uptodate() is false, and iomap_set_range_dirty() is called

with copied == 0.

Add a !len guard to both functions before the computation, so that a

zero-length range is a no-op.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References