GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-68145 (GCVE-0-2026-68145)

Vulnerability from cvelistv5 – Published: 2026-08-10 11:59 – Updated: 2026-08-23 12:45
VLAI
Title
iomap: fix out-of-bounds bitmap_set() with zero-length range
Summary
In the Linux kernel, the following vulnerability has been resolved: iomap: fix out-of-bounds bitmap_set() with zero-length range ifs_set_range_dirty() and ifs_set_range_uptodate() compute last_blk as (off + len - 1) >> i_blkbits. When off is 0 and len is 0, the unsigned subtraction underflows to SIZE_MAX, producing a huge last_blk and nr_blks value that causes bitmap_set() to write far beyond the ifs->state allocation. Regarding ifs_set_range_uptodate(), it is temporarily safe because len cannot be passed in as 0. However, for ifs_set_range_dirty() this is reachable from __iomap_write_end(): when copy_folio_from_iter_atomic() returns 0 (e.g. user buffer fault) and the folio is already uptodate, the guard at the top of __iomap_write_end() does not trigger because !folio_test_uptodate() is false, and iomap_set_range_dirty() is called with copied == 0. Add a !len guard to both functions before the computation, so that a zero-length range is a no-op.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4ce02c67972211be488408c275c8fbf19faf29b3 , < 48829622212f6b8f49155889aecc818ba28ba680 (git)
Affected: 4ce02c67972211be488408c275c8fbf19faf29b3 , < fb4fad9105c88b1d82f1b3c39e3b6abea8249af6 (git)
Affected: 4ce02c67972211be488408c275c8fbf19faf29b3 , < 7037e7bdcd26f46c080b8ce307dee5cb471c4b7c (git)
Affected: 4ce02c67972211be488408c275c8fbf19faf29b3 , < c5b6a48a8a716a7730e39af1cad083dc4ec955ce (git)
Affected: 4ce02c67972211be488408c275c8fbf19faf29b3 , < 9c7d8f7c8994c790fca501dc45ce66e7356cbe05 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.153 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/iomap/buffered-io.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "48829622212f6b8f49155889aecc818ba28ba680",
              "status": "affected",
              "version": "4ce02c67972211be488408c275c8fbf19faf29b3",
              "versionType": "git"
            },
            {
              "lessThan": "fb4fad9105c88b1d82f1b3c39e3b6abea8249af6",
              "status": "affected",
              "version": "4ce02c67972211be488408c275c8fbf19faf29b3",
              "versionType": "git"
            },
            {
              "lessThan": "7037e7bdcd26f46c080b8ce307dee5cb471c4b7c",
              "status": "affected",
              "version": "4ce02c67972211be488408c275c8fbf19faf29b3",
              "versionType": "git"
            },
            {
              "lessThan": "c5b6a48a8a716a7730e39af1cad083dc4ec955ce",
              "status": "affected",
              "version": "4ce02c67972211be488408c275c8fbf19faf29b3",
              "versionType": "git"
            },
            {
              "lessThan": "9c7d8f7c8994c790fca501dc45ce66e7356cbe05",
              "status": "affected",
              "version": "4ce02c67972211be488408c275c8fbf19faf29b3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/iomap/buffered-io.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niomap: fix out-of-bounds bitmap_set() with zero-length range\n\nifs_set_range_dirty() and ifs_set_range_uptodate() compute last_blk\nas (off + len - 1) \u003e\u003e i_blkbits.  When off is 0 and len is 0, the\nunsigned subtraction underflows to SIZE_MAX, producing a huge\nlast_blk and nr_blks value that causes bitmap_set() to write far\nbeyond the ifs-\u003estate allocation.\n\nRegarding ifs_set_range_uptodate(), it is temporarily safe because len\ncannot be passed in as 0. However, for ifs_set_range_dirty() this is\nreachable from __iomap_write_end(): when copy_folio_from_iter_atomic()\nreturns 0 (e.g. user buffer fault) and the folio is already uptodate,\nthe guard at the top of __iomap_write_end() does not trigger because\n!folio_test_uptodate() is false, and iomap_set_range_dirty() is called\nwith copied == 0.\n\nAdd a !len guard to both functions before the computation, so that a\nzero-length range is a no-op."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached via the buffered write() path through iomap_file_buffered_write() when copy_folio_from_iter_atomic() returns 0; NFS/ksmbd server writes use kernel bvec iterators and do not hit this user-buffer fault path.\nAC:L - An attacker can reliably trigger copied==0 by racing munmap/remap against write() on an already-uptodate folio (TOCTOU after fault_in_iov_iter_readable), controlling both sides of the race on systems where folio size exceeds filesystem block size.\nPR:L - Only standard local write permission to a file on an iomap-backed filesystem (XFS, GFS2, FUSE writeback-cache, zonefs, NTFS) is required; no CAP_SYS_ADMIN or other elevated capability is needed beyond creating/triggering writes to attacker-writable files.\nUI:N - Exploitation requires only the attacker\u0027s own write operations to a writable file; no action by another user or administrator (such as mounting a filesystem or opening a file on the victim\u0027s behalf) is needed.\nS:U - Successful exploitation corrupts host kernel heap memory and enables local privilege escalation within the same kernel security domain; it does not inherently cross VM, container, or IOMMU boundaries.\nC:H - ifs_set_range_dirty() with len==0 underflows to SIZE_MAX and bitmap_set() writes far beyond the small kzalloc_flex(ifs-\u003estate) allocation, corrupting adjacent kmalloc objects in ways that can be leveraged for arbitrary kernel memory disclosure.\nI:H - The out-of-bounds bitmap_set() is a large heap overwrite primitive adjacent to the iomap_folio_state allocation, enabling control of kernel data structures and arbitrary code execution via standard heap exploitation techniques.\nA:H - The massive out-of-bounds write can immediately corrupt critical kernel heap metadata or adjacent objects, causing kernel oops/panic or unrecoverable memory corruption even before full exploitation is attempted."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:45:56.875Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/48829622212f6b8f49155889aecc818ba28ba680"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb4fad9105c88b1d82f1b3c39e3b6abea8249af6"
        },
        {
          "url": "https://git.kernel.org/stable/c/7037e7bdcd26f46c080b8ce307dee5cb471c4b7c"
        },
        {
          "url": "https://git.kernel.org/stable/c/c5b6a48a8a716a7730e39af1cad083dc4ec955ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c7d8f7c8994c790fca501dc45ce66e7356cbe05"
        }
      ],
      "title": "iomap: fix out-of-bounds bitmap_set() with zero-length range",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68145",
    "datePublished": "2026-08-10T11:59:09.721Z",
    "dateReserved": "2026-07-30T09:28:09.371Z",
    "dateUpdated": "2026-08-23T12:45:56.875Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68145",
      "date": "2026-09-16",
      "epss": "0.00138",
      "percentile": "0.03551"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68145\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:20:00.350\",\"lastModified\":\"2026-08-23T13:16:33.943\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\niomap: fix out-of-bounds bitmap_set() with zero-length range\\n\\nifs_set_range_dirty() and ifs_set_range_uptodate() compute last_blk\\nas (off + len - 1) \u003e\u003e i_blkbits.  When off is 0 and len is 0, the\\nunsigned subtraction underflows to SIZE_MAX, producing a huge\\nlast_blk and nr_blks value that causes bitmap_set() to write far\\nbeyond the ifs-\u003estate allocation.\\n\\nRegarding ifs_set_range_uptodate(), it is temporarily safe because len\\ncannot be passed in as 0. However, for ifs_set_range_dirty() this is\\nreachable from __iomap_write_end(): when copy_folio_from_iter_atomic()\\nreturns 0 (e.g. user buffer fault) and the folio is already uptodate,\\nthe guard at the top of __iomap_write_end() does not trigger because\\n!folio_test_uptodate() is false, and iomap_set_range_dirty() is called\\nwith copied == 0.\\n\\nAdd a !len guard to both functions before the computation, so that a\\nzero-length range is a no-op.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/iomap/buffered-io.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4ce02c67972211be488408c275c8fbf19faf29b3\",\"lessThan\":\"48829622212f6b8f49155889aecc818ba28ba680\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4ce02c67972211be488408c275c8fbf19faf29b3\",\"lessThan\":\"fb4fad9105c88b1d82f1b3c39e3b6abea8249af6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4ce02c67972211be488408c275c8fbf19faf29b3\",\"lessThan\":\"7037e7bdcd26f46c080b8ce307dee5cb471c4b7c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4ce02c67972211be488408c275c8fbf19faf29b3\",\"lessThan\":\"c5b6a48a8a716a7730e39af1cad083dc4ec955ce\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4ce02c67972211be488408c275c8fbf19faf29b3\",\"lessThan\":\"9c7d8f7c8994c790fca501dc45ce66e7356cbe05\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/iomap/buffered-io.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.153\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.101\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/48829622212f6b8f49155889aecc818ba28ba680\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7037e7bdcd26f46c080b8ce307dee5cb471c4b7c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9c7d8f7c8994c790fca501dc45ce66e7356cbe05\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c5b6a48a8a716a7730e39af1cad083dc4ec955ce\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fb4fad9105c88b1d82f1b3c39e3b6abea8249af6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-04T07:52:35+00:00",
      "cve": "CVE-2026-68145",
      "id": "CVE-2026-68145",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:fixed": "612",
      "product_status:known_not_affected": "112",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iomap: fix out-of-bounds bitmap_set() with zero-length range",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68145.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:41:04Z",
      "cve": "CVE-2026-68145",
      "id": "CVE-2026-68145",
      "initial_release_date": "2026-08-18T16:56:09Z",
      "product_status:first_fixed": "65",
      "product_status:known_affected": "423",
      "product_status:known_not_affected": "324",
      "product_status:recommended": "125",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68145",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68145.json",
      "version": "8"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.