Executive brief
A vulnerability was identified in the Linux kernel's file handling system (iomap) that occurs when processing data at specific memory boundaries. This flaw could allow an attacker to cause a system crash or potentially access sensitive information by triggering an incorrect memory calculation during file read operations. The issue primarily affects systems using specific file system configurations like EROFS.
Technical details
The vulnerability exists within the iomap_adjust_read_range() function in fs/iomap/buffered-io.c. The function incorrectly assumes that input positions and lengths are always block-aligned. When processing non-block-aligned positions (as seen in EROFS), the kernel may skip too many bytes for blocks already marked as up-to-date. This leads to an integer underflow of the length variable and causes the kernel to return a memory position beyond the intended folio boundary. This can result in out-of-bounds reads or system instability. The fix involves accounting for the block offset when calculating skippable bytes. Patches have been released for various stable kernel branches including 6.6.y, 6.12.y, and 6.18.y.
Affected products
- Linux Linux Kernel 4.19 to 6.18.3
Timeline
- 2025-09-22: other: Patch authored
- 2026-01-13: advisory: CVE published
- 2026-01-08: patched: Patched in stable branches