CVE-2026-72107 - Vulnerability Details

- dm era: fix out-of-bounds memory access for non-zero start sector

Description

In the Linux kernel, the following vulnerability has been resolved:

dm era: fix out-of-bounds memory access for non-zero start sector

dm-era tracks writes in target-relative blocks, but era_map() calculates
the writeset block before applying the target offset. Tables with a
non-zero start sector can therefore pass an absolute mapped-device block
to metadata_current_marked().

If the absolute block is beyond the current writeset size,
writeset_marked() tests past the end of the in-core bitset. KASAN reports
this as a vmalloc-out-of-bounds access.

Apply the target offset before calculating the era block so writeset
lookups use the target-relative block number.

Published: 2026-08-15

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s dm‑era target contains a flaw in the calculation of writeset blocks for tables that specify a non‑zero start sector; because the target offset is applied after the block is computed, an absolute block number that exceeds the size of the in‑core writeset bitset can be passed to writeset_marked(), leading to an out‑of‑bounds memory read that KASAN reports as a vmalloc‑out‑bounds access. This vulnerability can corrupt kernel memory, causing system instability, crashes, or potential information leakage.

Affected Systems

Any Linux kernel that implements the dm‑era target and uses tables with a non‑zero start sector is potentially exposed. The vulnerability is present in all kernel releases prior to the application of the patch cited in the description.

Risk and Exploitability

The CVSS score of 8.8 denotes high severity, while the EPSS score of less than 1% indicates a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local access or the ability to configure a block device that uses dm‑era. Based on the description, it is inferred that a remote attacker would need to first gain sufficient local privileges to influence such a configuration.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`eec40579d84873dfb7021eb24c50360f073237c5`	affected	< fe94a0b14010a3c267ff9a2508afb4f27ff1c5bf
`eec40579d84873dfb7021eb24c50360f073237c5`	affected	< e3ffa8e492e5cdee62d916ee3e9244ccce2b73c5
`eec40579d84873dfb7021eb24c50360f073237c5`	affected	< 9946a7176bd8c25ddd6e5f1799c54e572ee6bf0f
`eec40579d84873dfb7021eb24c50360f073237c5`	affected	< 7e1822f83c5a1ee7b4a19e98edde8770a10b4c71
`eec40579d84873dfb7021eb24c50360f073237c5`	affected	< db5f9b4601f0012038e5a2628aedec2f47933380
`eec40579d84873dfb7021eb24c50360f073237c5`	affected	< 1fcb5e29dd7a5b85adb9d8b539911741d878e829
`eec40579d84873dfb7021eb24c50360f073237c5`	affected	< bafe3e720cdac38cd7ea4eb7852a8f2dbe1bbfe6
`eec40579d84873dfb7021eb24c50360f073237c5`	affected	< a868196f03c2b19418ae3d2b69e195d668a271e5

Linux

affected

Version	Status	Constraints
`3.15`	affected	—
`0`	unaffected	< 3.15
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[eec40579d84873dfb7021eb24c50360f073237c5,fe94a0b14010a3c267ff9a2508afb4f27ff1c5bf)`	affected	code_commit	—
`[eec40579d84873dfb7021eb24c50360f073237c5,e3ffa8e492e5cdee62d916ee3e9244ccce2b73c5)`	affected	code_commit	—
`[eec40579d84873dfb7021eb24c50360f073237c5,9946a7176bd8c25ddd6e5f1799c54e572ee6bf0f)`	affected	code_commit	—
`[eec40579d84873dfb7021eb24c50360f073237c5,7e1822f83c5a1ee7b4a19e98edde8770a10b4c71)`	affected	code_commit	—
`[eec40579d84873dfb7021eb24c50360f073237c5,db5f9b4601f0012038e5a2628aedec2f47933380)`	affected	code_commit	—
`[eec40579d84873dfb7021eb24c50360f073237c5,1fcb5e29dd7a5b85adb9d8b539911741d878e829)`	affected	code_commit	—
`[eec40579d84873dfb7021eb24c50360f073237c5,bafe3e720cdac38cd7ea4eb7852a8f2dbe1bbfe6)`	affected	code_commit	—
`[eec40579d84873dfb7021eb24c50360f073237c5,a868196f03c2b19418ae3d2b69e195d668a271e5)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.15`	affected	generic	—
`[0,3.15)`	unaffected	semver	—
`[5.10.261,5.10.*]`	unaffected	generic	—
`[5.15.212,5.15.*]`	unaffected	generic	—
`[6.1.178,6.1.*]`	unaffected	generic	—
`[6.6.145,6.6.*]`	unaffected	generic	—
`[6.12.97,6.12.*]`	unaffected	generic	—
`[6.18.40,6.18.*]`	unaffected	generic	—
`[7.1.5,7.1.*]`	unaffected	generic	—
`[7.2-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the dm‑era out‑of‑bounds fix
If upgrading is not immediately feasible, disable or remove dm‑era targets that employ non‑zero start sectors on affected block devices
Restrict write access to block devices using dm‑era by applying strict udev rules or device‑mapper permission settings

Generated by OpenCVE AI on August 17, 2026 at 21:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00632.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1fcb5e29dd7a5b85adb9d8b539911741d878e829
https://git.kernel.org/stable/c/7e1822f83c5a1ee7b4a19e98edde8770a10b4c71
https://git.kernel.org/stable/c/9946a7176bd8c25ddd6e5f1799c54e572ee6bf0f
https://git.kernel.org/stable/c/a868196f03c2b19418ae3d2b69e195d668a271e5
https://git.kernel.org/stable/c/bafe3e720cdac38cd7ea4eb7852a8f2dbe1bbfe6
https://git.kernel.org/stable/c/db5f9b4601f0012038e5a2628aedec2f47933380
https://git.kernel.org/stable/c/e3ffa8e492e5cdee62d916ee3e9244ccce2b73c5
https://git.kernel.org/stable/c/fe94a0b14010a3c267ff9a2508afb4f27ff1c5bf
https://lore.kernel.org/linux-cve-announce/2026081526-CVE-2026-72107-0676@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-72107
https://www.cve.org/CVERecord?id=CVE-2026-72107

History

Tue, 18 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026081526-CVE-2026-72107-0676@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-72107 https://www.cve.org/CVERecord?id=CVE-2026-72107
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 17 Aug 2026 22:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125

Mon, 17 Aug 2026 20:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-120

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 15 Aug 2026 20:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-120

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: dm era: fix out-of-bounds memory access for non-zero start sector dm-era tracks writes in target-relative blocks, but era_map() calculates the writeset block before applying the target offset. Tables with a non-zero start sector can therefore pass an absolute mapped-device block to metadata_current_marked(). If the absolute block is beyond the current writeset size, writeset_marked() tests past the end of the in-core bitset. KASAN reports this as a vmalloc-out-of-bounds access. Apply the target offset before calculating the era block so writeset lookups use the target-relative block number.
Title		dm era: fix out-of-bounds memory access for non-zero start sector
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1fcb5e29dd7a5b85adb9d8b539911741d878e829 https://git.kernel.org/stable/c/7e1822f83c5a1ee7b4a19e98edde8770a10b4c71 https://git.kernel.org/stable/c/9946a7176bd8c25ddd6e5f1799c54e572ee6bf0f https://git.kernel.org/stable/c/a868196f03c2b19418ae3d2b69e195d668a271e5 https://git.kernel.org/stable/c/bafe3e720cdac38cd7ea4eb7852a8f2dbe1bbfe6 https://git.kernel.org/stable/c/db5f9b4601f0012038e5a2628aedec2f47933380 https://git.kernel.org/stable/c/e3ffa8e492e5cdee62d916ee3e9244ccce2b73c5 https://git.kernel.org/stable/c/fe94a0b14010a3c267ff9a2508afb4f27ff1c5bf

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:52:49.581Z

Updated: 2026-08-17T05:40:20.098Z

Reserved: 2026-08-09T03:40:39.906Z

Link: CVE-2026-72107

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:21:24.920

Modified: 2026-08-17T06:18:09.717

Link: CVE-2026-72107

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72107 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-17T22:00:03Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object