CVE-2026-72098

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-72098
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72098.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-72098
Downstream
ALSA (4)
AZL (1)
BELL (1)
CLSA (2)
DEBIAN (1)
OESA (2)
openSUSE (1)
RHSA (7)
RLSA (4)
SUSE (16)
UBUNTU (1)
Related
ALSA (4)
openSUSE (1)
SUSE (16)
Published
2026-08-15T05:52:43Z
Modified
2026-11-01T02:30:19Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
dm-verity: fix buffer overflow in FEC calculation
Details

In the Linux kernel, the following vulnerability has been resolved:

dm-verity: fix buffer overflow in FEC calculation

There's a buffer overflow in dm-verity-fec:

if (neras && *neras <= v->fec->roots) fio->erasures[(*neras)++] = i;

This allows *neras to reach roots + 1 (the post-increment pushes it past roots). This value is then passed as no_eras to decode_rs8(). Inside the RS decoder (lib/reed_solomon/decode_rs.c:113-121), the erasure locator polynomial loop writes lambda[j] where j can reach nroots + 1 — one element past the end of lambda[] (which is sized nroots + 1, valid indices 0..nroots). The out-of-bounds write lands on syn[0], corrupting the syndrome buffer.

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72098.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
a739ff3f543afbb4a041c16cd0182c8e8d366e70
Fixed
84d4d2a6988c9a733f7821452cefb5b0d93de2d1
Fixed
374775626c327aec2425c16b4d36706e5f8718b8
Fixed
dc662eed1c432cc2fd4e9314f58d30b3a8cca7cc
Fixed
5488d3a69d205e28f74f18857b853aa12e778e66
Fixed
f7990c2b0f08b8841fcd2652d1d7002f5994a7a7
Fixed
31d6e6c0ba8d5a7bd59660035a089307100c5e8e

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72098.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.5.0
Fixed
6.1.191
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.160
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.114
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.42
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.1.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72098.json"