CVE-2026-72367: iomap: guard io_size EOF trim against concurrent truncate underflow
In the Linux kernel, the following vulnerability has been resolved:
iomap: guard iosize EOF trim against concurrent truncate underflow
iomap: fix zero padding data issue in concurrent append writes changed ioend accounting so that iosize tracks only valid data within EOF. This trims iosize when a writeback range extends past endpos:
ioend->iosize += maplen; if (ioend->iooffset + ioend->iosize > endpos) ioend->iosize = endpos - ioend->iooffset;
However, if endpos ends up below ioend->iooffset, the subtraction becomes negative and is stored in sizet iosize, causing an unsigned wrap to a huge value. This can happen when writeback continues past byte-level EOF up to a block-aligned range, or when a concurrent truncate shrinks the file after endpos was sampled in iomapwritebackhandleeof().
A wrapped iosize can mislead append detection and corrupt completion-time size handling, since filesystem endio paths consume iosize for decisions such as on-disk EOF updates and unwritten/COW completion ranges.
Fix this by clamping iosize to zero when EOF has moved to or before the ioend start offset. This preserves the original intent of trimming iosize to valid in-EOF data while avoiding the underflow.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Compensating control
Clamp io_size to zero when EOF has moved to or before the ioend start offset, preventing end_pos - ioend->io_offset from underflowing and wrapping to a huge size_t value.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72367?
CVE-2026-72367 has a risk score of 38, indicating a moderate severity level.
How do I fix CVE-2026-72367?
To fix CVE-2026-72367, ensure that your Linux kernel is updated to the latest patched version that addresses the vulnerability.
What systems are affected by CVE-2026-72367?
CVE-2026-72367 affects the Linux kernel specifically when handling concurrent truncate operations and io_size management.
What is the potential impact of CVE-2026-72367?
The potential impact of CVE-2026-72367 includes data corruption due to incorrect io_size accounting during concurrent write operations.
Is CVE-2026-72367 a critical vulnerability?
No, CVE-2026-72367 is not classified as a critical vulnerability based on its risk score, but it still requires attention.