CVE-2026-72367

A flaw was found in the Linux kernel's iomap subsystem. This vulnerability occurs due to an integer underflow when calculating io_size during concurrent file truncation operations. If a file is truncated while writeback is in progress, the io_size can wrap to a large value, leading to incorrect handling of file data. This can result in data corruption within the filesystem.

This vulnerability is rated as having a Moderate impact for Red Hat because triggering the flaw requires local execution privileges to induce a race condition between file truncation and writeback operations. Although corrupting size accounting in the storage layer can lead to filesystem anomalies or denial of service, it cannot be exploited remotely and does not directly permit privilege escalation. Default configurations and security policies that constrain untrusted local user activity further mitigate practical exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.