---
id: CVE-2026-68145
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  iomap: fix out-of-bounds bitmap_set() with zero-length range

  ifs_set_range_dirty() and ifs_set_range_uptodate() compute last_blk
  as (off + len - 1) >> i_blkbits
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  iomap: fix out-of-bounds bitmap_set() with zero-length range

  ifs_set_range_dirty() and ifs_set_range_uptodate() compute last_blk
  as (off + len - 1) >> i_blkbits.  When…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
published: '2026-08-10'
updated: '2026-08-23'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-68145'
references:
  - url: 'https://git.kernel.org/stable/c/48829622212f6b8f49155889aecc818ba28ba680'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7037e7bdcd26f46c080b8ce307dee5cb471c4b7c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9c7d8f7c8994c790fca501dc45ce66e7356cbe05'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c5b6a48a8a716a7730e39af1cad083dc4ec955ce'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fb4fad9105c88b1d82f1b3c39e3b6abea8249af6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00138
epssPercentile: 0.03555
ingestedAt: '2026-08-23T13:48:06.282Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

iomap: fix out-of-bounds bitmap_set() with zero-length range

ifs_set_range_dirty() and ifs_set_range_uptodate() compute last_blk
as (off + len - 1) >> i_blkbits.  When off is 0 and len is 0, the
unsigned subtraction underflows to SIZE_MAX, producing a huge
last_blk and nr_blks value that causes bitmap_set() to write far
beyond the ifs->state allocation.

Regarding ifs_set_range_uptodate(), it is temporarily safe because len
cannot be passed in as 0. However, for ifs_set_range_dirty() this is
reachable from __iomap_write_end(): when copy_folio_from_iter_atomic()
returns 0 (e.g. user buffer fault) and the folio is already uptodate,
the guard at the top of __iomap_write_end() does not trigger because
!folio_test_uptodate() is false, and iomap_set_range_dirty() is called
with copied == 0.

Add a !len guard to both functions before the computation, so that a
zero-length range is a no-op.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.