CVE-2026-68145 iomap: fix out-of-bounds bitmap_set() with zero-length range
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-68145?
CVE-2026-68145 is a high-severity vulnerability in Linux, published on 10 Aug 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
iomap: fix out-of-bounds bitmap_set() with zero-length range
ifs_set_range_dirty() and ifs_set_range_uptodate() compute last_blk as (off + len - 1) >> i_blkbits. When off is 0 and len is 0, the unsigned subtraction underflows to SIZE_MAX, producing a huge last_blk and nr_blks value that causes bitmap_set() to write far beyond the ifs->state allocation.
Regarding ifs_set_range_uptodate(), it is temporarily safe because len cannot be passed in as 0. However, for ifs_set_range_dirty() this is reachable from __iomap_write_end(): when copy_folio_from_iter_atomic() returns 0 (e.g. user buffer fault) and the folio is already uptodate, the guard at the top of __iomap_write_end() does not trigger because !folio_test_uptodate() is false, and iomap_set_range_dirty() is called with copied == 0.
Add a !len guard to both functions before the computation, so that a zero-length range is a no-op.
Weakness: CWE-190
Which versions are affected by CVE-2026-68145?
How do I fix CVE-2026-68145?
Upgrade to a fixed version.
Is CVE-2026-68145 being exploited?
There is no known exploitation of CVE-2026-68145 in the wild and no public exploit code.
Sources
Also known as AZL-94719, BELL-CVE-2026-68145, DEBIAN-CVE-2026-68145, GHSA-gr2w-phmc-qw83, UBUNTU-CVE-2026-68145.