device-mapper-persistent-data, a component of Red Hat operating systems and OpenShift, contains an arithmetic error in its synchronous block reading logic. When a local attacker crafts device metadata with an excessively large block index, the application processes the data, the integer calculation overflows or underflows, and the process panics. The resulting crash prevents the tool from completing its task, causing a denial of service for the user or system that invoked it. This flaw matches CWE‑190, which denotes an integer overflow/underflow vulnerability.

Affected products are Red Hat Enterprise Linux versions 6 to 10 and Red Hat OpenShift Container Platform 4. The vulnerability resides in the device-mapper-persistent-data package shipped with these platforms; any system that uses this package and allows local users or privileged services to craft and process device metadata is potentially impacted. No specific minor versions are excluded, so all current releases should be considered vulnerable until a fix is issued.

With a CVSS score of 3.3 the flaw is classified as low severity, and the EPSS score of < 1% indicates a very low exploitation probability. The vulnerability is not listed in CISA KEV, suggesting no publicly known active exploits. The attack vector is local; a malicious user or a compromised local process must generate or manipulate device metadata. While privilege escalation is not required, an attacker who controls a local application that interacts with device‑mapper‑persistent‑data could trigger the crash, leading to service interruptions.