{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-72367 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-72367 is a high-severity vulnerability in Linux, published on 15 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-72367 and fix it if it is affected.\n\nWhat it is: CVE-2026-72367 is a high-severity vulnerability in Linux, published on 15 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-72367 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-72367/ (Markdown: https://insights.sbomify.com/CVE-2026-72367/index.md)","id":"CVE-2026-72367","markdown":"https://insights.sbomify.com/CVE-2026-72367/index.md","name":"CVE-2026-72367","record":{"aliases":["BELL-CVE-2026-72367","DEBIAN-CVE-2026-72367","GHSA-r9wm-p769-97j8","UBUNTU-CVE-2026-72367"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["data_modify","denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A concurrent truncate during writeback causes an integer underflow in the Linux kernel, potentially corrupting file size metadata or causing denial of service.","user_interaction":"not_required","vuln_class":"integer_overflow"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":8.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\niomap: guard io_size EOF trim against concurrent truncate underflow\n\niomap: fix zero padding data issue in concurrent append writes\nchanged ioend accounting so that io_size tracks only valid data\nwithin EOF.  This trims io_size when a writeback range extends\npast end_pos:\n\n    ioend-\u003eio_size += map_len;\n    if (ioend-\u003eio_offset + ioend-\u003eio_size \u003e end_pos)\n        ioend-\u003eio_size = end_pos - ioend-\u003eio_offset;\n\nHowever, if end_pos ends up below ioend-\u003eio_offset, the subtraction\nbecomes negative and is stored in size_t io_size, causing an unsigned\nwrap to a huge value.  This can happen when writeback continues past\nbyte-level EOF up to a block-aligned range, or when a concurrent\ntruncate shrinks the file after end_pos was sampled in\niomap_writeback_handle_eof().\n\nA wrapped io_size can mislead append detection and corrupt\ncompletion-time size handling, since filesystem end_io paths consume\nio_size for decisions such as on-disk EOF updates and unwritten/COW\ncompletion ranges.\n\nFix this by clamping io_size to zero when EOF has moved to or before\nthe ioend start offset.  This preserves the original intent of trimming\nio_size to valid in-EOF data while avoiding the underflow.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"iomap: guard io_size EOF trim against concurrent truncate underflow","id":"CVE-2026-72367","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"integer_overflow","year":"2026"},"n_packages":0,"n_references":4,"next":{"headline":"cachefiles: Fix double unlock in nomem_d_alloc error path","id":"CVE-2026-72368"},"packages":[],"prev":{"headline":"netfs: Fix netfs_create_write_req() to handle async cache object creation","id":"CVE-2026-72366"},"products":["Linux"],"published":"2026-08-15","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-21","vendors":["Linux"]},"summary":"A concurrent truncate during writeback causes an integer underflow in the Linux kernel, potentially corrupting file size metadata or causing denial of service.","url":"https://insights.sbomify.com/CVE-2026-72367/"}