CVE-2025-68794

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-68794", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-24T10:30:51.037Z", "datePublished": "2026-01-13T15:29:05.553Z", "dateUpdated": "2026-10-19T18:05:07.542Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-27T12:39:37.848Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niomap: adjust read range correctly for non-block-aligned positions\n\niomap_adjust_read_range() assumes that the position and length passed in\nare block-aligned. This is not always the case however, as shown in the\nsyzbot generated case for erofs. This causes too many bytes to be\nskipped for uptodate blocks, which results in returning the incorrect\nposition and length to read in. If all the blocks are uptodate, this\nunderflows length and returns a position beyond the folio.\n\nFix the calculation to also take into account the block offset when\ncalculating how many bytes can be skipped for uptodate blocks."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - EROFS supports NFS export, allowing a remote NFS READ request to reach nfsd, filemap, erofs_read_folio or erofs_readahead, and the vulnerable iomap function.\nAC:L - The underflow is deterministic once a non-block-aligned range intersects leading uptodate blocks; no race or condition outside the attacker\u2019s control is required.\nPR:N - A public NFS export can accept RPC_AUTH_NULL, map the requester to the anonymous identity, and permit access to a world-readable trigger file without authentication.\nUI:N - The remote attacker directly triggers the vulnerable reads, including any repetitions needed to establish partial-uptodate state, without victim action.\nS:U - The corruption compromises the kernel and resources governed by the same host security authority, without inherently crossing a VM, IOMMU, or other scope boundary.\nC:H - The underflow can create an almost-4-GiB BIO vector spanning unrelated physical pages; the resulting kernel memory corruption can support code execution and arbitrary information disclosure.\nI:H - Attacker-controlled filesystem data can be read through the malformed BIO into unrelated kernel memory, providing a powerful corruption primitive capable of control-flow hijacking.\nA:H - Hole or post-EOF paths reach bounds BUG_ON checks, while mapped paths can corrupt extensive kernel memory, either of which can panic or otherwise crash the system."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/iomap/buffered-io.c"], "versions": [{"version": "9dc55f1389f9569acf9659e58dd836a9c70df217", "lessThan": "ce20f49ac9194cf81a77f01d1c316d7c17ae753c", "status": "affected", "versionType": "git"}, {"version": "9dc55f1389f9569acf9659e58dd836a9c70df217", "lessThan": "275b37a1e5c2c8abd313e8075f6aec9a349f291b", "status": "affected", "versionType": "git"}, {"version": "9dc55f1389f9569acf9659e58dd836a9c70df217", "lessThan": "b8c9f25fd84328c5fcc4f70c6d1e8f1d4787eaac", "status": "affected", "versionType": "git"}, {"version": "9dc55f1389f9569acf9659e58dd836a9c70df217", "lessThan": "82b60ffbb532d919959702768dca04c3c0500ae5", "status": "affected", "versionType": "git"}, {"version": "9dc55f1389f9569acf9659e58dd836a9c70df217", "lessThan": "12053695c8ef5410e8cc6c9ed4c0db9cd9c82b3e", "status": "affected", "versionType": "git"}, {"version": "9dc55f1389f9569acf9659e58dd836a9c70df217", "lessThan": "142194fb21afe964d2d194cab1fc357cbf87e899", "status": "affected", "versionType": "git"}, {"version": "9dc55f1389f9569acf9659e58dd836a9c70df217", "lessThan": "7aa6bc3e8766990824f66ca76c19596ce10daf3e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/iomap/buffered-io.c"], "versions": [{"version": "4.19", "status": "affected"}, {"version": "0", "lessThan": "4.19", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.267", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.218", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.185", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.120", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.64", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.3", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.10.267"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.15.218"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.1.185"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.6.120"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.12.64"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.18.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ce20f49ac9194cf81a77f01d1c316d7c17ae753c"}, {"url": "https://git.kernel.org/stable/c/275b37a1e5c2c8abd313e8075f6aec9a349f291b"}, {"url": "https://git.kernel.org/stable/c/b8c9f25fd84328c5fcc4f70c6d1e8f1d4787eaac"}, {"url": "https://git.kernel.org/stable/c/82b60ffbb532d919959702768dca04c3c0500ae5"}, {"url": "https://git.kernel.org/stable/c/12053695c8ef5410e8cc6c9ed4c0db9cd9c82b3e"}, {"url": "https://git.kernel.org/stable/c/142194fb21afe964d2d194cab1fc357cbf87e899"}, {"url": "https://git.kernel.org/stable/c/7aa6bc3e8766990824f66ca76c19596ce10daf3e"}], "title": "iomap: adjust read range correctly for non-block-aligned positions", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-68794", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:05:19.306500Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T18:05:07.542Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-68794", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:05:19.306500Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:05:20.127Z"}}], "cna": {"title": "iomap: adjust read range correctly for non-block-aligned positions", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - EROFS supports NFS export, allowing a remote NFS READ request to reach nfsd, filemap, erofs_read_folio or erofs_readahead, and the vulnerable iomap function.\nAC:L - The underflow is deterministic once a non-block-aligned range intersects leading uptodate blocks; no race or condition outside the attacker\u2019s control is required.\nPR:N - A public NFS export can accept RPC_AUTH_NULL, map the requester to the anonymous identity, and permit access to a world-readable trigger file without authentication.\nUI:N - The remote attacker directly triggers the vulnerable reads, including any repetitions needed to establish partial-uptodate state, without victim action.\nS:U - The corruption compromises the kernel and resources governed by the same host security authority, without inherently crossing a VM, IOMMU, or other scope boundary.\nC:H - The underflow can create an almost-4-GiB BIO vector spanning unrelated physical pages; the resulting kernel memory corruption can support code execution and arbitrary information disclosure.\nI:H - Attacker-controlled filesystem data can be read through the malformed BIO into unrelated kernel memory, providing a powerful corruption primitive capable of control-flow hijacking.\nA:H - Hole or post-EOF paths reach bounds BUG_ON checks, while mapped paths can corrupt extensive kernel memory, either of which can panic or otherwise crash the system."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "9dc55f1389f9569acf9659e58dd836a9c70df217", "lessThan": "ce20f49ac9194cf81a77f01d1c316d7c17ae753c", "versionType": "git"}, {"status": "affected", "version": "9dc55f1389f9569acf9659e58dd836a9c70df217", "lessThan": "275b37a1e5c2c8abd313e8075f6aec9a349f291b", "versionType": "git"}, {"status": "affected", "version": "9dc55f1389f9569acf9659e58dd836a9c70df217", "lessThan": "b8c9f25fd84328c5fcc4f70c6d1e8f1d4787eaac", "versionType": "git"}, {"status": "affected", "version": "9dc55f1389f9569acf9659e58dd836a9c70df217", "lessThan": "82b60ffbb532d919959702768dca04c3c0500ae5", "versionType": "git"}, {"status": "affected", "version": "9dc55f1389f9569acf9659e58dd836a9c70df217", "lessThan": "12053695c8ef5410e8cc6c9ed4c0db9cd9c82b3e", "versionType": "git"}, {"status": "affected", "version": "9dc55f1389f9569acf9659e58dd836a9c70df217", "lessThan": "142194fb21afe964d2d194cab1fc357cbf87e899", "versionType": "git"}, {"status": "affected", "version": "9dc55f1389f9569acf9659e58dd836a9c70df217", "lessThan": "7aa6bc3e8766990824f66ca76c19596ce10daf3e", "versionType": "git"}], "programFiles": ["fs/iomap/buffered-io.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.19"}, {"status": "unaffected", "version": "0", "lessThan": "4.19", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.267", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.218", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.185", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.120", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.64", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.3", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/iomap/buffered-io.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/ce20f49ac9194cf81a77f01d1c316d7c17ae753c"}, {"url": "https://git.kernel.org/stable/c/275b37a1e5c2c8abd313e8075f6aec9a349f291b"}, {"url": "https://git.kernel.org/stable/c/b8c9f25fd84328c5fcc4f70c6d1e8f1d4787eaac"}, {"url": "https://git.kernel.org/stable/c/82b60ffbb532d919959702768dca04c3c0500ae5"}, {"url": "https://git.kernel.org/stable/c/12053695c8ef5410e8cc6c9ed4c0db9cd9c82b3e"}, {"url": "https://git.kernel.org/stable/c/142194fb21afe964d2d194cab1fc357cbf87e899"}, {"url": "https://git.kernel.org/stable/c/7aa6bc3e8766990824f66ca76c19596ce10daf3e"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niomap: adjust read range correctly for non-block-aligned positions\n\niomap_adjust_read_range() assumes that the position and length passed in\nare block-aligned. This is not always the case however, as shown in the\nsyzbot generated case for erofs. This causes too many bytes to be\nskipped for uptodate blocks, which results in returning the incorrect\nposition and length to read in. If all the blocks are uptodate, this\nunderflows length and returns a position beyond the folio.\n\nFix the calculation to also take into account the block offset when\ncalculating how many bytes can be skipped for uptodate blocks."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.267", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.218", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.185", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.120", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.64", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.3", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19", "versionStartIncluding": "4.19"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-27T12:39:37.848Z"}}}, "cveMetadata": {"cveId": "CVE-2025-68794", "state": "PUBLISHED", "dateUpdated": "2026-10-19T18:05:07.542Z", "dateReserved": "2025-12-24T10:30:51.037Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-01-13T15:29:05.553Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/iomap/buffered-io.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ce20f49ac9194cf81a77f01d1c316d7c17ae753c", "status": "affected", "version": "9dc55f1389f9569acf9659e58dd836a9c70df217", "versionType": "git"}, {"lessThan": "275b37a1e5c2c8abd313e8075f6aec9a349f291b", "status": "affected", "version": "9dc55f1389f9569acf9659e58dd836a9c70df217", "versionType": "git"}, {"lessThan": "b8c9f25fd84328c5fcc4f70c6d1e8f1d4787eaac", "status": "affected", "version": "9dc55f1389f9569acf9659e58dd836a9c70df217", "versionType": "git"}, {"lessThan": "82b60ffbb532d919959702768dca04c3c0500ae5", "status": "affected", "version": "9dc55f1389f9569acf9659e58dd836a9c70df217", "versionType": "git"}, {"lessThan": "12053695c8ef5410e8cc6c9ed4c0db9cd9c82b3e", "status": "affected", "version": "9dc55f1389f9569acf9659e58dd836a9c70df217", "versionType": "git"}, {"lessThan": "142194fb21afe964d2d194cab1fc357cbf87e899", "status": "affected", "version": "9dc55f1389f9569acf9659e58dd836a9c70df217", "versionType": "git"}, {"lessThan": "7aa6bc3e8766990824f66ca76c19596ce10daf3e", "status": "affected", "version": "9dc55f1389f9569acf9659e58dd836a9c70df217", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/iomap/buffered-io.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.19"}, {"lessThan": "4.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.267", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.218", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.185", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.120", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.64", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niomap: adjust read range correctly for non-block-aligned positions\n\niomap_adjust_read_range() assumes that the position and length passed in\nare block-aligned. This is not always the case however, as shown in the\nsyzbot generated case for erofs. This causes too many bytes to be\nskipped for uptodate blocks, which results in returning the incorrect\nposition and length to read in. If all the blocks are uptodate, this\nunderflows length and returns a position beyond the folio.\n\nFix the calculation to also take into account the block offset when\ncalculating how many bytes can be skipped for uptodate blocks."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\niomap: ajustar el rango de lectura correctamente para posiciones no alineadas a bloques\n\niomap_adjust_read_range() asume que la posici\u00f3n y la longitud pasadas est\u00e1n alineadas a bloques. Sin embargo, este no siempre es el caso, como se muestra en el caso generado por syzbot para erofs. Esto causa que se salten demasiados bytes para bloques actualizados, lo que resulta en la devoluci\u00f3n de una posici\u00f3n y longitud incorrectas para leer. Si todos los bloques est\u00e1n actualizados, esto provoca un desbordamiento negativo de la longitud y devuelve una posici\u00f3n m\u00e1s all\u00e1 del folio.\n\nCorregir el c\u00e1lculo para tambi\u00e9n tener en cuenta el desplazamiento del bloque al calcular cu\u00e1ntos bytes pueden ser saltados para bloques actualizados."}], "id": "CVE-2025-68794", "lastModified": "2026-10-19T19:17:05.397", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-68794", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:05:19.306500Z", "version": "2.0.3"}}]}, "published": "2026-01-13T16:16:01.310", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/12053695c8ef5410e8cc6c9ed4c0db9cd9c82b3e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/142194fb21afe964d2d194cab1fc357cbf87e899"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/275b37a1e5c2c8abd313e8075f6aec9a349f291b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7aa6bc3e8766990824f66ca76c19596ce10daf3e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/82b60ffbb532d919959702768dca04c3c0500ae5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b8c9f25fd84328c5fcc4f70c6d1e8f1d4787eaac"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ce20f49ac9194cf81a77f01d1c316d7c17ae753c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: iomap: adjust read range correctly for non-block-aligned positions", "id": "2429040", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429040"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\niomap: adjust read range correctly for non-block-aligned positions\niomap_adjust_read_range() assumes that the position and length passed in\nare block-aligned. This is not always the case however, as shown in the\nsyzbot generated case for erofs. This causes too many bytes to be\nskipped for uptodate blocks, which results in returning the incorrect\nposition and length to read in. If all the blocks are uptodate, this\nunderflows length and returns a position beyond the folio.\nFix the calculation to also take into account the block offset when\ncalculating how many bytes can be skipped for uptodate blocks."], "name": "CVE-2025-68794", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-01-13T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-68794\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-68794\nhttps://lore.kernel.org/linux-cve-announce/2026011305-CVE-2025-68794-32db@gregkh/T"], "threat_severity": "Low"}

{}