CVE-2026-68145

In the Linux kernel, the following vulnerability has been resolved:

iomap: fix out-of-bounds bitmap_set() with zero-length range

ifssetrangedirty() and ifssetrangeuptodate() compute lastblk as (off + len - 1) >> iblkbits. When off is 0 and len is 0, the unsigned subtraction underflows to SIZEMAX, producing a huge lastblk and nrblks value that causes bitmapset() to write far beyond the ifs->state allocation.

Regarding ifssetrangeuptodate(), it is temporarily safe because len cannot be passed in as 0. However, for ifssetrangedirty() this is reachable from __iomapwriteend(): when copyfoliofromiteratomic() returns 0 (e.g. user buffer fault) and the folio is already uptodate, the guard at the top of _iomapwriteend() does not trigger because !foliotestuptodate() is false, and iomapsetrangedirty() is called with copied == 0.

Add a !len guard to both functions before the computation, so that a zero-length range is a no-op.