CVE-2025-68794: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68794 is an integer underflow vulnerability in the Linux kernel's iomap_adjust_read_range() function caused by incorrect handling of non-block-aligned I/O positions. The function incorrectly assumes that position and length parameters are always block-aligned, leading to erroneous byte-skip calculations for uptodate blocks. When all blocks are uptodate, this causes a length underflow and returns a position beyond the folio, resulting in data corruption and potential kernel crashes. Affected Linux kernel versions span from the initial commit up to (but not including) 6.6.120, 6.12.64, 6.18.3, and 6.19-rc1; Microsoft's Azure Linux Kernel (azl3_kernel_6.6.119.3-3) is also affected. The vulnerability was published on January 13, 2026, with a CVSS v3.1 base score of 6.1 (Medium) (Feedly).

The root cause is an off-by-one/integer underflow calculation error (related to CWE-191: Integer Underflow) in iomap_adjust_read_range() within the Linux kernel's iomap subsystem. The function fails to account for the block offset when computing how many bytes can be skipped for uptodate blocks, assuming all inputs are block-aligned. This flaw was surfaced by a syzbot-generated test case involving the erofs filesystem, where non-block-aligned read positions are possible. When all blocks in the range are marked uptodate, the length variable underflows and the returned position exceeds the folio boundary, corrupting subsequent read operations. The fix involves incorporating the block offset into the skip calculation (Feedly).

A local attacker with low privileges can trigger data integrity failures and denial-of-service conditions by inducing non-block-aligned I/O operations on affected filesystems such as erofs. Exploitation can result in incorrect data being returned from storage reads (data corruption) and kernel crashes due to the underflow condition, impacting system availability. The vulnerability is confined to the local system with no network-based attack vector, limiting lateral movement potential, but data corruption could affect any files accessed through the vulnerable code path (Feedly).

Apply the available kernel patches immediately. Fixed versions include Linux kernel 6.6.120, 6.12.64, 6.18.3, and 6.19-rc1 or newer. For Microsoft Azure Linux (azl3_kernel), apply the security update released on January 15, 2026. Ubuntu has issued multiple security notices (USN-8177-1, USN-8179-1, USN-8183-1, USN-8184-1, USN-8185-1, and subsequent revisions) addressing this vulnerability. SUSE has also released patches (SUSE-SU-2026:1661-1 and related advisories). Prioritize patching systems that use filesystems with non-block-aligned I/O, such as erofs (Feedly, Ubuntu USN-8177-1, SUSE Advisory).