Linux Kernel EUVD-2026-59266

Exploitation requires a low-privileged user with write access to a file on a filesystem that uses the Linux kernel iomap writeback layer (XFS, ext4 iomap path, and others). The race condition is triggered when two concurrent operations overlap: (1) a writeback operation that extends to a block-aligned boundary past byte-level EOF, and (2) a concurrent truncate(2) that shrinks the file after end_pos was already sampled in iomap_writeback_handle_eof(). The timing window is narrow and filesystem-dependent, making reliable exploitation difficult. Exploitation is further limited to kernel versions in the affected commit range (post-51d20d1dacbec589d459e11fc88fbca419f84a99, pre-fix commits). Systems running patched kernels (6.18.40, 7.1.5, 7.2-rc2) are not affected. Purely read-only workloads or filesystems not using the iomap layer are not affected.

The official NVD CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8) appears overstated on two axes. First, AV:N implies pure network reachability; while network filesystem clients (NFS, CIFS) could in theory trigger this through remote I/O operations, the race condition is an internal kernel synchronization issue unlikely to be reliably triggered over a network path. A local or adjacent vector is more consistent with the mechanism. Second, AC:L understates the exploitation difficulty: successfully triggering this requires a precise race between concurrent writeback and truncate(2), which is timing-dependent and inherently AC:H. The EPSS score of 0.21% at the 11th percentile is consistent with this assessment - the combination of race condition, kernel-level access requirements, and lack of any known POC makes mass exploitation unlikely. The vulnerability is NOT listed in CISA KEV. Real-world risk is primarily data integrity corruption on affected filesystems (XFS, ext4, etc.) rather than direct code execution. The C:H/I:H/A:H impact ratings may reflect worst-case filesystem corruption or kernel panic scenarios. CVSS and EPSS are conflicting signals: high CVSS suggests severe impact; low EPSS reflects low exploitation probability - this is a real-risk-but-unlikely-exploited pattern.

A local or network-filesystem-connected low-privileged user opens a file on an iomap-backed filesystem (e.g., XFS) and simultaneously performs rapid append writes while a concurrent thread or process issues truncate(2) to shrink the file. If the truncate executes between iomap_writeback_handle_eof() sampling end_pos and the io_size trim calculation, end_pos falls below ioend->io_offset, causing io_size to underflow to a near-maximal size_t value. The corrupted io_size is then used by the filesystem end_io completion path, potentially writing an incorrect on-disk EOF, completing incorrect unwritten extents, or triggering a kernel BUG/panic. No public proof-of-concept exploit has been identified at time of analysis.