CVE-2026-68145 Overview
CVE-2026-68145 is an out-of-bounds write vulnerability in the Linux kernel's iomap subsystem. The flaw resides in the ifs_set_range_dirty() and ifs_set_range_uptodate() functions, which compute last_blk as (off + len - 1) >> i_blkbits. When both off and len are zero, the unsigned subtraction underflows to SIZE_MAX, producing a large last_blk and nr_blks value that causes bitmap_set() to write far beyond the ifs->state allocation.
The issue is reachable from __iomap_write_end() when copy_folio_from_iter_atomic() returns 0 on a folio that is already uptodate, invoking iomap_set_range_dirty() with copied == 0.
Critical Impact
A local, low-privileged user can trigger heap memory corruption in the kernel, leading to denial of service or potential privilege escalation.
Affected Products
- Linux kernel (mainline, prior to the fixing commits)
- Stable kernel branches referenced in the four kernel.org commits
- Filesystems using the iomap buffered write path (e.g., XFS, ext4 with iomap, GFS2, Zonefs)
Discovery Timeline
- 2026-08-10 - CVE-2026-68145 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-68145
Vulnerability Analysis
The vulnerability is a kernel-space out-of-bounds write triggered by an integer underflow. The iomap layer maintains per-folio state through an iomap_folio_state (ifs) structure, which tracks dirty and uptodate sub-blocks using a bitmap. Helper functions update ranges within this bitmap when writes complete.
Both ifs_set_range_dirty() and ifs_set_range_uptodate() compute the last block index using (off + len - 1) >> i_blkbits. This expression assumes len is greater than zero. When len equals zero and off equals zero, the expression 0 + 0 - 1 underflows in unsigned arithmetic to SIZE_MAX. The resulting nr_blks value causes bitmap_set() to write far past the end of the ifs->state allocation, corrupting adjacent kernel heap memory.
Root Cause
The root cause is missing input validation for zero-length ranges. The functions do not guard against len == 0 before performing the subtraction, exposing an integer underflow condition in unsigned arithmetic.
Attack Vector
The vulnerable path is reachable from __iomap_write_end(). When copy_folio_from_iter_atomic() returns zero, for example after a user buffer fault, and the folio is already marked uptodate, the top-level guard in __iomap_write_end() does not trigger because !folio_test_uptodate() evaluates to false. The code then calls iomap_set_range_dirty() with copied == 0, propagating the zero-length range into ifs_set_range_dirty() and triggering the out-of-bounds write.
A local attacker with the ability to perform buffered writes against a supported filesystem can induce the fault condition and reach the vulnerable code path.
No verified proof-of-concept code is published. See the upstream fix commit for the exact patched logic.
Detection Methods for CVE-2026-68145
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing bitmap_set, ifs_set_range_dirty, or iomap_set_range_dirty in dmesg or /var/log/kern.log.
- KASAN reports flagging slab-out-of-bounds writes originating from the iomap buffered write path.
- Filesystem corruption on iomap-backed volumes such as XFS following user-space write faults.
Detection Strategies
- Enable KASAN and lockdep on test kernels to catch out-of-bounds writes near ifs->state allocations.
- Audit kernel crash telemetry for repeated panics in the iomap write completion code paths.
- Track kernel versions across the fleet and flag hosts running kernels prior to the fixing commits 7037e7bdcd26, 9c7d8f7c8994, c5b6a48a8a71, and fb4fad9105c8.
Monitoring Recommendations
- Forward kernel.crit and kernel.err syslog facilities to a centralized log platform and alert on iomap-related stack traces.
- Monitor for abnormal process termination and filesystem remounts to read-only mode on affected servers.
- Correlate host telemetry with kernel package inventory to prioritize unpatched systems.
How to Mitigate CVE-2026-68145
Immediate Actions Required
- Apply the upstream kernel patches referenced in the four git.kernel.org commits as soon as your distribution ships them.
- Prioritize patching multi-tenant Linux hosts where untrusted local users can perform buffered writes.
- Restrict local shell access on high-value systems until patches are deployed.
Patch Information
The fix adds a !len guard to both ifs_set_range_dirty() and ifs_set_range_uptodate() so that a zero-length range becomes a no-op. Patches are available in the following commits: 7037e7bdcd26, 9c7d8f7c8994, c5b6a48a8a71, and fb4fad9105c8. Rebuild and deploy kernels containing these commits, or install the corresponding vendor-provided kernel updates.
Workarounds
- No official workaround exists; only the upstream patch fully addresses the underflow.
- Reduce exposure by limiting untrusted local user accounts on servers using iomap-backed filesystems.
- Enable KASAN on non-production systems to detect exploitation attempts during triage.
# Verify running kernel version and apply distribution updates
uname -r
# Debian / Ubuntu
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r)
# RHEL / Rocky / Alma
sudo dnf update kernel
# Reboot into the patched kernel
sudo reboot
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
