Executive brief
The Linux kernel's file I/O mapping subsystem contains an integer overflow vulnerability in 32-bit systems when calculating file positions during write operations. An attacker with local access could exploit this to cause a denial of service or corrupt file system data by triggering incorrect memory address calculations.
Technical details
The vulnerability is an integer overflow in the iomap_write_delalloc_scan() function in fs/iomap/buffered-io.c. The vulnerable code uses folio_next_index() (which returns an unsigned long) left-shifted by PAGE_SHIFT, causing overflow on 32-bit systems when computing file byte positions. The fix replaces this with folio_pos(folio) + folio_size(folio), which correctly handles the calculation. This is a local vulnerability reachable through normal file I/O operations on systems with deferred write-back allocation. Patches are available in Linux kernel stable branches.
Affected products
- Linux Linux kernel multiple versions prior to patch (fix in stable branches)
Timeline
- 2025-12-30: disclosed
- 2023-09-23: patched: Fix available in Linux kernel stable branches