Linux kernel iomap: io_size underflows to a huge value when a concurrent truncate moves EOF below the ioend start

Impact

The writeback path trims ioend->io_size to what lies inside EOF by subtracting io_offset from end_pos. If EOF has moved to or below io_offset - a concurrent truncate shrinking the file after end_pos was sampled, or writeback running past byte-level EOF to a block-aligned boundary - the subtraction goes negative and wraps in the size_t io_size to an enormous value. Filesystem end_io paths consume io_size to decide on-disk EOF updates and unwritten/COW completion ranges, so a wrapped value can mislead append detection and corrupt completion-time size handling. The practical exposure on a GPU node is a local workload writing and truncating the same file concurrently on an iomap-based filesystem (XFS, and others using iomap writeback) - checkpoint writers and dataset shards are plausible triggers. This is local and requires the right race, not something a remote peer reaches; the risk is data integrity on the node's filesystem rather than tenant escape. The fix clamps io_size to zero when EOF has moved to or before the ioend start.

Who can reach it

A local user or workload able to write to and truncate a file on an iomap-based filesystem, which on a shared node includes any tenant with a writable mount. No special privileges; needs a race with writeback.

What to do

Take the stable kernel that carries the iomap clamp fix and reboot each node to pick it up - there is no module reload or runtime mitigation for a writeback path change. Batch it with the next kernel maintenance window rather than scheduling an emergency drain, given the local-only, race-dependent exposure.

References

Related entries

• Linux kernel xen/pvcalls: malicious backend req_id drives an out-of-bounds write in the PV frontendCVE-2026-72380 · Linux kernel xen/pvcalls frontend (unbounded backend req_id indexing rsp[])High
• Linux kernel BPF: conntrack kfuncs write opts->error outside the verifier-checked rangeCVE-2026-72423 · Linux kernel BPF conntrack kfuncs (opts__sz bounds on opts->error)High
• Linux kernel (drivers/iommu): Every peer-to-peer segment in a scatter-gather list inherits the length of the firstCVE-2026-74277 · Linux kernel (drivers/iommu)High
• Linux kernel (drivers/iommu/iommufd): Iommufd tears down the page-tracking state behind a dma-buf backed IOAS mappingCVE-2026-74328 · Linux kernel (drivers/iommu/iommufd)High
• Linux kernel (drivers/iommu): An I/O page-fault group is handed to userspace through iommufd while still sitting on theCVE-2026-74520 · Linux kernel (drivers/iommu)High
• Xen XPTI: PV guest memory above the directmap boundary leads to host compromise from a PV guestCVE-2026-79609 · Xen hypervisor XPTI (64-bit PV guest root page-table copy via directmap)High