# CVE-2026-72367: iomap: guard io_size EOF trim against concurrent truncate underflow

> A concurrent truncate during writeback causes an integer underflow in the Linux kernel, potentially corrupting file size metadata or causing denial of service.

- **Severity:** High 8.8 (`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 15 Aug 2026
- **Updated:** 21 Oct 2026
- **Also known as:** BELL-CVE-2026-72367, DEBIAN-CVE-2026-72367, GHSA-r9wm-p769-97j8, UBUNTU-CVE-2026-72367

## What is CVE-2026-72367?

CVE-2026-72367 is a high-severity vulnerability in Linux, published on 15 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

iomap: guard io_size EOF trim against concurrent truncate underflow

iomap: fix zero padding data issue in concurrent append writes
changed ioend accounting so that io_size tracks only valid data
within EOF.  This trims io_size when a writeback range extends
past end_pos:

    ioend->io_size += map_len;
    if (ioend->io_offset + ioend->io_size > end_pos)
        ioend->io_size = end_pos - ioend->io_offset;

However, if end_pos ends up below ioend->io_offset, the subtraction
becomes negative and is stored in size_t io_size, causing an unsigned
wrap to a huge value.  This can happen when writeback continues past
byte-level EOF up to a block-aligned range, or when a concurrent
truncate shrinks the file after end_pos was sampled in
iomap_writeback_handle_eof().

A wrapped io_size can mislead append detection and corrupt
completion-time size handling, since filesystem end_io paths consume
io_size for decisions such as on-disk EOF updates and unwritten/COW
completion ranges.

Fix this by clamping io_size to zero when EOF has moved to or before
the ioend start offset.  This preserves the original intent of trimming
io_size to valid in-EOF data while avoiding the underflow.

## Which versions are affected by CVE-2026-72367?


## How do I fix CVE-2026-72367?

Apply the vendor's patch.

## Is CVE-2026-72367 being exploited?

There is no known exploitation of CVE-2026-72367 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-72367 and fix it if it is affected.

What it is: CVE-2026-72367 is a high-severity vulnerability in Linux, published on 15 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-72367 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-72367/ (Markdown: https://insights.sbomify.com/CVE-2026-72367/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-72367
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-72367
- OSV: https://osv.dev/vulnerability/CVE-2026-72367

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-72367/
Summaries are generated and may contain mistakes; the official description above is the record.