CVE-2026-72367

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

iomap: guard io_size EOF trim against concurrent truncate underflow

iomap: fix zero padding data issue in concurrent append writes

changed ioend accounting so that io_size tracks only valid data

within EOF. This trims io_size when a writeback range extends

past end_pos:

ioend->io_size += map_len;

if (ioend->io_offset + ioend->io_size > end_pos)

ioend->io_size = end_pos - ioend->io_offset;

However, if end_pos ends up below ioend->io_offset, the subtraction

becomes negative and is stored in size_t io_size, causing an unsigned

wrap to a huge value. This can happen when writeback continues past

byte-level EOF up to a block-aligned range, or when a concurrent

truncate shrinks the file after end_pos was sampled in

iomap_writeback_handle_eof().

A wrapped io_size can mislead append detection and corrupt

completion-time size handling, since filesystem end_io paths consume

io_size for decisions such as on-

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References