iomap: adjust read range correctly for non-block-aligned positions (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.69 % · percentile 53 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Deferred
Description
In the Linux kernel, the following vulnerability has been resolved: iomap: adjust read range correctly for non-block-aligned positions iomap_adjust_read_range() assumes that the position and length passed in are block-aligned. This is not always the case however, as shown in the syzbot generated case for erofs. This causes too many bytes to be skipped for uptodate blocks, which results in returning the incorrect position and length to read in. If all the blocks are uptodate, this underflows length and returns a position beyond the folio. Fix the calculation to also take into account the block offset when calculating how many bytes can be skipped for uptodate blocks.
Weaknesses (CWE)
- CWE-190 — Integer Overflow or Wraparound
References
- https://git.kernel.org/stable/c/ce20f49ac9194cf81a77f01d1c316d7c17ae753c
- https://git.kernel.org/stable/c/275b37a1e5c2c8abd313e8075f6aec9a349f291b
- https://git.kernel.org/stable/c/b8c9f25fd84328c5fcc4f70c6d1e8f1d4787eaac
- https://git.kernel.org/stable/c/82b60ffbb532d919959702768dca04c3c0500ae5
- https://git.kernel.org/stable/c/12053695c8ef5410e8cc6c9ed4c0db9cd9c82b3e
- https://git.kernel.org/stable/c/142194fb21afe964d2d194cab1fc357cbf87e899
- https://git.kernel.org/stable/c/7aa6bc3e8766990824f66ca76c19596ce10daf3e
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | Linux |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
European references
- ENISA EUVD · EUVD-2026-2308
- GCVE · GCVE-0-2025-68794
CERT-FR advisories
- CERTFR-2026-AVI-1163 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0787 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0602 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0546 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0545 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0522 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0497 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0495 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0453 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0326 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0316 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0166 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 9dc55f1389f9569acf9659e58dd836a9c70df217 < ce20f49ac9194cf81a77f01d1c316d7c17ae753c ; affected 9dc55f1389f9569acf9659e58dd836a9c70df217 < 275b37a1e5c2c8abd313e8075f6aec9a349f291b ; affected 9dc55f1389f9569acf9659e58dd836a9c70df217 < b8c9f25fd84328c5fcc4f70c6d1e8f1d4787eaac ; affected 9dc55f1389f9569acf9659e58dd836a9c70df217 < 82b60ffbb532d919959702768dca04c3c0500ae5 ; affected 9dc55f1389f9569acf9659e58dd836a9c70df217 < 12053695c8ef5410e8cc6c9ed4c0db9cd9c82b3e ; affected 9dc55f1389f9569acf9659e58dd836a9c70df217 < 142194fb21afe964d2d194cab1fc357cbf87e899 |
| Linux · Linux | affected 4.19 ; unaffected 0 < 4.19 ; unaffected 5.10.267 ≤ 5.10.* ; unaffected 5.15.218 ≤ 5.15.* ; unaffected 6.1.185 ≤ 6.1.* ; unaffected 6.6.120 ≤ 6.6.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |