CVE-2026-72367 iomap: guard io_size EOF trim against concurrent truncate underflow
A concurrent truncate during writeback causes an integer underflow in the Linux kernel, potentially corrupting file size metadata or causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72367?
CVE-2026-72367 is a high-severity vulnerability in Linux, published on 15 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
iomap: guard io_size EOF trim against concurrent truncate underflow
iomap: fix zero padding data issue in concurrent append writes changed ioend accounting so that io_size tracks only valid data within EOF. This trims io_size when a writeback range extends past end_pos:
ioend->io_size += map_len; if (ioend->io_offset + ioend->io_size > end_pos) ioend->io_size = end_pos - ioend->io_offset;
However, if end_pos ends up below ioend->io_offset, the subtraction becomes negative and is stored in size_t io_size, causing an unsigned wrap to a huge value. This can happen when writeback continues past byte-level EOF up to a block-aligned range, or when a concurrent truncate shrinks the file after end_pos was sampled in iomap_writeback_handle_eof().
A wrapped io_size can mislead append detection and corrupt completion-time size handling, since filesystem end_io paths consume io_size for decisions such as on-disk EOF updates and unwritten/COW completion ranges.
Fix this by clamping io_size to zero when EOF has moved to or before the ioend start offset. This preserves the original intent of trimming io_size to valid in-EOF data while avoiding the underflow.
Which versions are affected by CVE-2026-72367?
How do I fix CVE-2026-72367?
Apply the vendor's patch.
Is CVE-2026-72367 being exploited?
There is no known exploitation of CVE-2026-72367 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72367, DEBIAN-CVE-2026-72367, GHSA-r9wm-p769-97j8, UBUNTU-CVE-2026-72367.