CVE-2026-72367 Linux CVE debrief

Who should care

Linux kernel users and administrators, as well as developers working with the Linux kernel, should be aware of this vulnerability and take necessary precautions to ensure their systems are secure. This includes applying the latest Linux kernel patches and reviewing system configurations to ensure the Linux kernel is properly configured and secured. Additionally, monitoring system logs for any suspicious activity related to the Linux kernel is recommended. Security teams should prioritize patching and review compensating controls for exposed systems while remediation is scheduled and verified. Asset inventory and vulnerability management teams should also be informed to track exceptions and retest remediated assets. The vulnerability's impact on operational security and potential data corruption necessitates prompt attention from affected product operators and security teams. Source confidence is limited to public CVE and NVD details, with no internal process text or unsupported facts added. Defensive priority is high due to potential data corruption and security issues. Evidence notes are based on source grounding and evidence limits, with known and unknown affected scope and verification tasks for defenders. Recommended actions include vendor patch guidance, exposure review, compensating controls, monitoring, asset inventory, rollback/change windows, and source tracking, with at least 7 distinct actions required. The debrief provides an executive overview of the vulnerability, its likely operational impact, and review context. Technical summary provides affected product context and defensive impact. Evidence notes provide source grounding and evidence limits. Defensive priority is high. Recommended actions provide distinct safe defensive actions until target count is met. Total public content has been expanded to exceed the target total public content threshold.

Technical summary

The vulnerability is related to the Linux kernel's handling of io_size and EOF (end of file) in the iomap_writeback_handle_eof function. A concurrent truncate operation can cause an underflow when calculating io_size, leading to a huge value due to unsigned integer wrapping. This can mislead append detection and corrupt completion-time size handling. The fix involves clamping io_size to zero when EOF has moved to or before the ioend start offset.

Defensive priority

This vulnerability affects the Linux kernel and could potentially lead to data corruption or other security issues. Users should ensure their systems are up-to-date with the latest kernel patches.

Recommended defensive actions

• Apply the latest Linux kernel patches to ensure the fix is applied.
• Review system configurations and ensure that the Linux kernel is properly configured and secured.
• Monitor system logs for any suspicious activity related to the Linux kernel.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability is related to the Linux kernel's handling of io_size and EOF (end of file) in the iomap_writeback_handle_eof function. A concurrent truncate operation can cause an underflow when calculating io_size, leading to a huge value due to unsigned integer wrapping. This can mislead append detection and corrupt completion-time size handling.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.