{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.5-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  iomap: guard io_size EOF trim against concurrent truncate underflow  iomap: fix zero padding data issue in concurrent append writes changed ioend accounting so that io_size tracks only valid data within EOF.  This trims io_size when a writeback range extends past end_pos:      ioend-\u003eio_size += map_len;     if (ioend-\u003eio_offset + ioend-\u003eio_size \u003e end_pos)         ioend-\u003eio_size = end_pos - ioend-\u003eio_offset;  However, if end_pos ends up below ioend-\u003eio_offset, the subtraction becomes negative and is stored in size_t io_size, causing an unsigned wrap to a huge value.  This can happen when writeback continues past byte-level EOF up to a block-aligned range, or when a concurrent truncate shrinks the file after end_pos was sampled in iomap_writeback_handle_eof().  A wrapped io_size can mislead append detection and corrupt completion-time size handling, since filesystem end_io paths consume io_size for decisions such as on-disk EOF updates and unwritten/COW completion ranges.  Fix this by clamping io_size to zero when EOF has moved to or before the ioend start offset.  This preserves the original intent of trimming io_size to valid in-EOF data while avoiding the underflow.",
  "id": "DEBIAN-CVE-2026-72367",
  "modified": "2026-09-14T16:47:44.805356907Z",
  "published": "2026-08-15T06:22:10.117Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-72367"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-72367"
  ]
}