CVE-2026-68145

A flaw was found in the Linux kernel's iomap subsystem. An unsigned subtraction underflow occurs when ifs_set_range_dirty() or ifs_set_range_uptodate() are called with a zero-length range. This can lead to an out-of-bounds write via bitmap_set(), potentially allowing a local attacker to cause memory corruption or a denial of service.

This vulnerability is rated as Important severity because an unprivileged local attacker can trigger kernel memory corruption during standard buffered file write operations, presenting a severe risk to system integrity and availability. Successful exploitation may lead to a kernel crash or potential local privilege escalation. Because the iomap framework is built directly into the kernel to handle core filesystem operations, typical Red Hat Enterprise Linux installations are exposed if local unprivileged access is permitted.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.