CVE-2026-68145— iomap: fix out-of-bounds bitmap_set() with zero-length range

iomap: fix out-of-bounds bitmap_set() with zero-length range

In the Linux kernel, the following vulnerability has been resolved: iomap: fix out-of-bounds bitmap_set() with zero-length range ifs_set_range_dirty() and ifs_set_range_uptodate() compute last_blk as (off + len - 1) >> i_blkbits. When off is 0 and len is 0, the unsigned subtraction underflows to SIZE_MAX, producing a huge last_blk and nr_blks value that causes bitmap_set() to write far beyond the ifs->state allocation. Regarding ifs_set_range_uptodate(), it is temporarily safe because len cannot be passed in as 0. However, for ifs_set_range_dirty() this is reachable from __iomap_write_end(): when copy_folio_from_iter_atomic() returns 0 (e.g. user buffer fault) and the folio is already uptodate, the guard at the top of __iomap_write_end() does not trigger because !folio_test_uptodate() is false, and iomap_set_range_dirty() is called with copied == 0. Add a !len guard to both functions before the computation, so that a zero-length range is a no-op.

N/A

N/A

Linux kernel 安全漏洞

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 6.6版本存在安全漏洞，该漏洞源于ifs_set_range_dirty()和ifs_set_range_uptodate()在计算last_blk时，当off和len均为0时，无符号减法下溢，导致bitmap_set()越界写入，可能造成内核内存损坏。

N/A

N/A