The iomap subsystem in the Linux kernel can corrupt kernel memory when it processes a zero‑length range during a write operation. When the offset is zero and the length is zero, the calculation of the last block underflows, leading to a gigantic last_blk value that causes bitmap_set to write far beyond the allocated state buffer. This out‑of‑bounds write corrupts kernel memory, resulting in a local kernel memory corruption that could allow an attacker with local access to gain higher privileges or cause a system crash. The bug is reached during a failed write completion path that marks a region dirty with a zero length.

The issue resides entirely within the Linux kernel, affecting all kernel releases before the commit that introduced the guard. Vendors running any default Linux distribution with a kernel older than the patch should consider this flaw present.

The CVSS score of 7.8 indicates high severity, yet the memory corruption could still enable local privilege escalation or denial of service. The exploit would require the ability to initiate a write that triggers the failure path, so the attack is local. The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not yet been observed. Nonetheless, the severity of the bug warrants prompt remediation.