The iomap subsystem in the Linux kernel has a flaw where processing a zero‑length range during a write causes an underflow. This produces an enormous last block value, and bitmap_set writes beyond the allocated buffer, corrupting kernel memory. The corruption can be triggered by a failed write completion path that marks an area dirty. An attacker with local access can exploit this corruption to alter kernel state, potentially elevating privileges or crashing the system.

All Linux kernel builds older than the commit that adds a non‑zero length guard in ifs_set_range_dirty and ifs_set_range_uptodate are vulnerable. Distributions that ship the affected kernel version without vendor backporting the fix are at risk.

The CVSS score of 7.8 reflects the severity of the out‑of‑bounds write. The EPSS score of less than 1% and absence in the CISA KEV catalogue suggest the likelihood of exploitation is currently low. Nevertheless, the bug requires only a local write operation that fails, making it a local attack vector that could provide privilege escalation or cause a denial of service.