Linux kernel iomap: zero-length write range underflows into an out-of-bounds bitmap_set()

Impact

iomap is the buffered-write path behind XFS and other modern filesystems, so this is core host kernel code on essentially every GPU node. When __iomap_write_end() is reached with copied == 0 (a faulting user buffer against an already-uptodate folio), the off + len - 1 subtraction underflows to SIZE_MAX and bitmap_set() writes far past the ifs->state allocation - kernel heap corruption driven by an unprivileged local process. Kernel heap corruption is not contained by the container boundary, so one tenant's job can crash or corrupt the host that every GPU on the box is attached to. The record shows the fix only; it does not demonstrate a working privilege escalation.

Who can reach it

Local and unprivileged. Any process that can write to an iomap-backed filesystem and arrange a faulting user buffer, which includes any tenant holding a container or pod on the node. No special device access and no authentication beyond having code execution on the host kernel.

What to do

Move to a stable kernel carrying the !len guard in ifs_set_range_dirty() and ifs_set_range_uptodate() (fixed across five stable branches, see the git.kernel.org commits) and reboot the node. There is no runtime mitigation - the path is the ordinary buffered write path and cannot be disabled. Budget a drain and reboot per node; the change is a two-line guard, so a livepatch may be feasible if your kernel vendor ships one.

References

Related entries

• Linux kernel libceph: use-after-free reading the monmap debugfs file during client teardownCVE-2026-68153 · Linux kernel libceph (per-client debugfs files vs client teardown)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-68257 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel sockmap: cork use-after-free when two threads send on the same socketCVE-2026-68284 · Linux kernel BPF sockmap (tcp_bpf_sendmsg cork handling)High
• Linux kernel (net/rds): Network-namespace teardown frees the per-netns RDS/TCP listen socket before unregistering theCVE-2026-68290 · Linux kernel (net/rds)High
• Linux kernel RDS (rds_find_bound socket lookup ignores network namespace): This is a literal cross-tenant delivery bug.CVE-2026-68335 · Linux kernel RDS (rds_find_bound socket lookup ignores network namespace)High
• Linux kernel mlx5_core MACsec offload: Deleting an offloaded MACsec RX secure channel frees the per-SC metadata_dstCVE-2026-72072 · Linux kernel mlx5_core MACsec offloadHigh