CVE-2026-72107

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-72107
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72107.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-72107
Downstream
Published
2026-08-15T05:52:49Z
Modified
2026-08-18T03:56:20Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
dm era: fix out-of-bounds memory access for non-zero start sector
Details

In the Linux kernel, the following vulnerability has been resolved:

dm era: fix out-of-bounds memory access for non-zero start sector

dm-era tracks writes in target-relative blocks, but era_map() calculates the writeset block before applying the target offset. Tables with a non-zero start sector can therefore pass an absolute mapped-device block to metadata_current_marked().

If the absolute block is beyond the current writeset size, writeset_marked() tests past the end of the in-core bitset. KASAN reports this as a vmalloc-out-of-bounds access.

Apply the target offset before calculating the era block so writeset lookups use the target-relative block number.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72107.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
eec40579d84873dfb7021eb24c50360f073237c5
Fixed
fe94a0b14010a3c267ff9a2508afb4f27ff1c5bf
Fixed
e3ffa8e492e5cdee62d916ee3e9244ccce2b73c5
Fixed
9946a7176bd8c25ddd6e5f1799c54e572ee6bf0f
Fixed
7e1822f83c5a1ee7b4a19e98edde8770a10b4c71
Fixed
db5f9b4601f0012038e5a2628aedec2f47933380
Fixed
1fcb5e29dd7a5b85adb9d8b539911741d878e829
Fixed
bafe3e720cdac38cd7ea4eb7852a8f2dbe1bbfe6
Fixed
a868196f03c2b19418ae3d2b69e195d668a271e5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72107.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.15.0
Fixed
5.10.261
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.212
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.178
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.145
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.97
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.40
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.1.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72107.json"