UBUNTU-CVE-2026-72367: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: iomap: guard iosize EOF trim against concurrent truncate underflow iomap: fix zero padding data issue in concurrent append writes changed ioend accounting so that iosize tracks only valid data within EOF. This trims iosize when a writeback range extends past endpos: ioend->iosize += maplen; if (ioend->iooffset + ioend->iosize > endpos) ioend->iosize = endpos - ioend->iooffset; However, if endpos ends up below ioend->iooffset, the subtraction becomes negative and is stored in sizet iosize, causing an unsigned wrap to a huge value. This can happen when writeback continues past byte-level EOF up to a block-aligned range, or when a concurrent truncate shrinks the file after endpos was sampled in iomapwritebackhandleeof(). A wrapped iosize can mislead append detection and corrupt completion-time size handling, since filesystem endio paths consume iosize for decisions such as on-disk EOF updates and unwritten/COW completion ranges. Fix this by clamping iosize to zero when EOF has moved to or before the ioend start offset. This preserves the original intent of trimming iosize to valid in-EOF data while avoiding the underflow.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the listed Ubuntu kernel packages may be exposed. Exploitation requires local access and low privileges; the supplied vector does not indicate a remote attack path or user interaction requirement.
What filesystem activity is needed to trigger the flaw?
The issue can occur when writeback extends beyond byte-level EOF into a block-aligned range, or when a concurrent truncate reduces the file after EOF was sampled during writeback. In that situation, the calculated I/O size can underflow and wrap to a very large unsigned value.
What is the likely effect of successful exploitation?
A wrapped I/O size can cause incorrect append detection and corrupt completion-time file-size handling. Filesystem end-I/O paths may make incorrect decisions about on-disk EOF updates and unwritten or copy-on-write completion ranges; the provided severity vector rates availability impact as high and integrity impact as low.