A flaw in libdm allows a remote attacker to supply a malicious LVM metadata configuration with deeply nested structures. The configuration file parser recurses without bounds, exhausting the process stack and causing any LVM command that reads the metadata to crash. The effect is a denial of service for the affected system. The weakness is categorized as CWE‑770, uncontrolled recursion.

Affected vendors include Red Hat Enterprise Linux 10, 6, 7, 8, and 9, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. The vulnerable component is the libdm library used by the LVM2 package on these distributions.

The CVSS base score of 5.7 indicates moderate severity; the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. Attackers can potentially craft the malicious metadata remotely if they can inject or modify LVM metadata files, or locally if they have write access to such files. The resulting crash only affects availability and does not allow code execution or data exposure. Because the exploitation requires the ability to supply the crafted metadata, the attack vector is inferred rather than explicitly stated in the description.