In the Linux kernel, the iomap subsystem can calculate an IO size larger than the file’s end position when a concurrent truncate reduces the file size below the current writeback offset. The calculation stores a huge unsigned value due to an underflow, misleading append detection and corrupting decisions made during end‑of‑file handling. An attacker who can trigger concurrent writes and truncations could potentially corrupt filesystem metadata or data, leading to data loss or denial of service. The weakness is an integer underflow in size handling.

All Linux kernel releases that include the unpatched iomap code are affected. Prior to the commit that clamps the IO size to zero when EOF has moved to or before the ioend start offset, any Linux kernel version used on the system is vulnerable. Exact kernel version numbers are not specified in the advisory, so all versions before the patch should be considered affected.

CVSS score of 8.8 indicates high severity. The EPSS score of < 1% indicates a low probability of exploitation. The vulnerability exists in kernel space, and based on the requirement to perform concurrent write and truncate operations on a file, it is inferred that local privileges are needed to trigger the conditions that lead to the underflow. Consequently, the vulnerability is not trivially exploitable over the network. Because it is not listed in the CISA KEV catalog and no public exploits are known, the likelihood of exploitation is moderate, but the potential impact on data integrity and service availability is high.