{"id":"CVE-2026-68145","state":"PUBLISHED","title":"iomap: fix out-of-bounds bitmap_set() with zero-length range","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niomap: fix out-of-bounds bitmap_set() with zero-length range\n\nifs_set_range_dirty() and ifs_set_range_uptodate() compute last_blk\nas (off + len - 1) >> i_blkbits.  When off is 0 and len is 0, the\nunsigned subtraction underflows to SIZE_MAX, producing a huge\nlast_blk and nr_blks value that causes bitmap_set() to write far\nbeyond the ifs->state allocation.\n\nRegarding ifs_set_range_uptodate(), it is temporarily safe because len\ncannot be passed in as 0. However, for ifs_set_range_dirty() this is\nreachable from __iomap_write_end(): when copy_folio_from_iter_atomic()\nreturns 0 (e.g. user buffer fault) and the folio is already uptodate,\nthe guard at the top of __iomap_write_end() does not trigger because\n!folio_test_uptodate() is false, and iomap_set_range_dirty() is called\nwith copied == 0.\n\nAdd a !len guard to both functions before the computation, so that a\nzero-length range is a no-op.","publishedAt":"2026-08-10T11:59:09.721Z","updatedAt":"2026-10-19T20:58:53.891Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"4ce02c67972211be488408c275c8fbf19faf29b3","status":"affected","lessThan":"48829622212f6b8f49155889aecc818ba28ba680","versionType":"git"},{"version":"4ce02c67972211be488408c275c8fbf19faf29b3","status":"affected","lessThan":"fb4fad9105c88b1d82f1b3c39e3b6abea8249af6","versionType":"git"},{"version":"4ce02c67972211be488408c275c8fbf19faf29b3","status":"affected","lessThan":"7037e7bdcd26f46c080b8ce307dee5cb471c4b7c","versionType":"git"},{"version":"4ce02c67972211be488408c275c8fbf19faf29b3","status":"affected","lessThan":"c5b6a48a8a716a7730e39af1cad083dc4ec955ce","versionType":"git"},{"version":"4ce02c67972211be488408c275c8fbf19faf29b3","status":"affected","lessThan":"9c7d8f7c8994c790fca501dc45ce66e7356cbe05","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/iomap/buffered-io.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.6","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.6","versionType":"semver"},{"version":"6.6.153","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.101","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.42","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.6","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/iomap/buffered-io.c"]}],"references":["https://git.kernel.org/stable/c/48829622212f6b8f49155889aecc818ba28ba680","https://git.kernel.org/stable/c/fb4fad9105c88b1d82f1b3c39e3b6abea8249af6","https://git.kernel.org/stable/c/7037e7bdcd26f46c080b8ce307dee5cb471c4b7c","https://git.kernel.org/stable/c/c5b6a48a8a716a7730e39af1cad083dc4ec955ce","https://git.kernel.org/stable/c/9c7d8f7c8994c790fca501dc45ce66e7356cbe05"],"weaknesses":["CWE-190"],"ingestedAt":"2026-10-29T20:12:49.727Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/68xxx/CVE-2026-68145.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68145","state":"PUBLISHED","datePublished":"2026-08-10T11:59:09.721Z","dateUpdated":"2026-10-19T20:58:53.891Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-30T09:28:09.371Z"},"containers":{"cna":{"title":"iomap: fix out-of-bounds bitmap_set() with zero-length range","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niomap: fix out-of-bounds bitmap_set() with zero-length range\n\nifs_set_range_dirty() and ifs_set_range_uptodate() compute last_blk\nas (off + len - 1) >> i_blkbits.  When off is 0 and len is 0, the\nunsigned subtraction underflows to SIZE_MAX, producing a huge\nlast_blk and nr_blks value that causes bitmap_set() to write far\nbeyond the ifs->state allocation.\n\nRegarding ifs_set_range_uptodate(), it is temporarily safe because len\ncannot be passed in as 0. However, for ifs_set_range_dirty() this is\nreachable from __iomap_write_end(): when copy_folio_from_iter_atomic()\nreturns 0 (e.g. user buffer fault) and the folio is already uptodate,\nthe guard at the top of __iomap_write_end() does not trigger because\n!folio_test_uptodate() is false, and iomap_set_range_dirty() is called\nwith copied == 0.\n\nAdd a !len guard to both functions before the computation, so that a\nzero-length range is a no-op."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"4ce02c67972211be488408c275c8fbf19faf29b3","status":"affected","lessThan":"48829622212f6b8f49155889aecc818ba28ba680","versionType":"git"},{"version":"4ce02c67972211be488408c275c8fbf19faf29b3","status":"affected","lessThan":"fb4fad9105c88b1d82f1b3c39e3b6abea8249af6","versionType":"git"},{"version":"4ce02c67972211be488408c275c8fbf19faf29b3","status":"affected","lessThan":"7037e7bdcd26f46c080b8ce307dee5cb471c4b7c","versionType":"git"},{"version":"4ce02c67972211be488408c275c8fbf19faf29b3","status":"affected","lessThan":"c5b6a48a8a716a7730e39af1cad083dc4ec955ce","versionType":"git"},{"version":"4ce02c67972211be488408c275c8fbf19faf29b3","status":"affected","lessThan":"9c7d8f7c8994c790fca501dc45ce66e7356cbe05","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/iomap/buffered-io.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.6","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.6","versionType":"semver"},{"version":"6.6.153","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.101","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.42","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.6","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/iomap/buffered-io.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/48829622212f6b8f49155889aecc818ba28ba680"},{"url":"https://git.kernel.org/stable/c/fb4fad9105c88b1d82f1b3c39e3b6abea8249af6"},{"url":"https://git.kernel.org/stable/c/7037e7bdcd26f46c080b8ce307dee5cb471c4b7c"},{"url":"https://git.kernel.org/stable/c/c5b6a48a8a716a7730e39af1cad083dc4ec955ce"},{"url":"https://git.kernel.org/stable/c/9c7d8f7c8994c790fca501dc45ce66e7356cbe05"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached via the buffered write() path through iomap_file_buffered_write() when copy_folio_from_iter_atomic() returns 0; NFS/ksmbd server writes use kernel bvec iterators and do not hit this user-buffer fault path.\nAC:L - An attacker can reliably trigger copied==0 by racing munmap/remap against write() on an already-uptodate folio (TOCTOU after fault_in_iov_iter_readable), controlling both sides of the race on systems where folio size exceeds filesystem block size.\nPR:L - Only standard local write permission to a file on an iomap-backed filesystem (XFS, GFS2, FUSE writeback-cache, zonefs, NTFS) is required; no CAP_SYS_ADMIN or other elevated capability is needed beyond creating/triggering writes to attacker-writable files.\nUI:N - Exploitation requires only the attacker's own write operations to a writable file; no action by another user or administrator (such as mounting a filesystem or opening a file on the victim's behalf) is needed.\nS:U - Successful exploitation corrupts host kernel heap memory and enables local privilege escalation within the same kernel security domain; it does not inherently cross VM, container, or IOMMU boundaries.\nC:H - ifs_set_range_dirty() with len==0 underflows to SIZE_MAX and bitmap_set() writes far beyond the small kzalloc_flex(ifs->state) allocation, corrupting adjacent kmalloc objects in ways that can be leveraged for arbitrary kernel memory disclosure.\nI:H - The out-of-bounds bitmap_set() is a large heap overwrite primitive adjacent to the iomap_folio_state allocation, enabling control of kernel data structures and arbitrary code execution via standard heap exploitation techniques.\nA:H - The massive out-of-bounds write can immediately corrupt critical kernel heap metadata or adjacent objects, causing kernel oops/panic or unrecoverable memory corruption even before full exploitation is attempted."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-23T12:45:56.875Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.6.153"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.12.101"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.18.42"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-68145","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T15:44:49.261769Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-190","lang":"en","type":"CWE","description":"CWE-190 Integer Overflow or Wraparound"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T20:58:53.891Z"}}]}}}