CVE-2026-72102 (GCVE-0-2026-72102)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:52 – Updated: 2026-08-17 05:40
VLAI
Title
dm_early_create: fix freeing used table on dm_resume failure
Summary
In the Linux kernel, the following vulnerability has been resolved: dm_early_create: fix freeing used table on dm_resume failure If dm_resume fails, the kernel attempts to free table with dm_table_destroy, but the table was already instantiated with dm_swap_table. This commit skips the call to dm_table_destroy in this case.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 6bbc923dfcf57d6b97388819a7393835664c7a8e , < 3ba377a47a093cc19647ca7f102acd33a211d472 (git)
Affected: 6bbc923dfcf57d6b97388819a7393835664c7a8e , < 72c3283a2abd60ecef295e02270f22ef1dfccd25 (git)
Affected: 6bbc923dfcf57d6b97388819a7393835664c7a8e , < d6066145347e14db84c35b445e309f095d0d8125 (git)
Affected: 6bbc923dfcf57d6b97388819a7393835664c7a8e , < 259ce9e3fc3a3f8c4e393a2072b8f34302eb4d5a (git)
Affected: 6bbc923dfcf57d6b97388819a7393835664c7a8e , < 5f6500d44a912d4aed664600966706d76b81d9af (git)
Affected: 6bbc923dfcf57d6b97388819a7393835664c7a8e , < 92e3c93d60be1f2425738cd66dbadac7d6bc0cd1 (git)
Affected: 6bbc923dfcf57d6b97388819a7393835664c7a8e , < 7d8ed7cb844df21e4d93af11250fb3a5cb861147 (git)
Affected: 6bbc923dfcf57d6b97388819a7393835664c7a8e , < 366665416f20527ff7cad548a32d1ddf23195740 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.1
Unaffected: 0 , < 5.1 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-ioctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3ba377a47a093cc19647ca7f102acd33a211d472",
              "status": "affected",
              "version": "6bbc923dfcf57d6b97388819a7393835664c7a8e",
              "versionType": "git"
            },
            {
              "lessThan": "72c3283a2abd60ecef295e02270f22ef1dfccd25",
              "status": "affected",
              "version": "6bbc923dfcf57d6b97388819a7393835664c7a8e",
              "versionType": "git"
            },
            {
              "lessThan": "d6066145347e14db84c35b445e309f095d0d8125",
              "status": "affected",
              "version": "6bbc923dfcf57d6b97388819a7393835664c7a8e",
              "versionType": "git"
            },
            {
              "lessThan": "259ce9e3fc3a3f8c4e393a2072b8f34302eb4d5a",
              "status": "affected",
              "version": "6bbc923dfcf57d6b97388819a7393835664c7a8e",
              "versionType": "git"
            },
            {
              "lessThan": "5f6500d44a912d4aed664600966706d76b81d9af",
              "status": "affected",
              "version": "6bbc923dfcf57d6b97388819a7393835664c7a8e",
              "versionType": "git"
            },
            {
              "lessThan": "92e3c93d60be1f2425738cd66dbadac7d6bc0cd1",
              "status": "affected",
              "version": "6bbc923dfcf57d6b97388819a7393835664c7a8e",
              "versionType": "git"
            },
            {
              "lessThan": "7d8ed7cb844df21e4d93af11250fb3a5cb861147",
              "status": "affected",
              "version": "6bbc923dfcf57d6b97388819a7393835664c7a8e",
              "versionType": "git"
            },
            {
              "lessThan": "366665416f20527ff7cad548a32d1ddf23195740",
              "status": "affected",
              "version": "6bbc923dfcf57d6b97388819a7393835664c7a8e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-ioctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "lessThan": "5.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm_early_create: fix freeing used table on dm_resume failure\n\nIf dm_resume fails, the kernel attempts to free table with\ndm_table_destroy, but the table was already instantiated with\ndm_swap_table. This commit skips the call to dm_table_destroy in this\ncase."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is only reachable via the dm-mod.create kernel boot parameter processed in late_initcall dm_init_init() calling dm_early_create(); there is no network, adjacent, ioctl, netlink, or post-boot userspace path into this __init-only device-mapper setup code.\nAC:L - Once dm_swap_table() installs the table, an attacker controlling dm-mod.create can deterministically force dm_resume() to fail (e.g., paired snapshot-origin preresume handover rejection or verity/crypt preresume errors) without races or attacker-uncontrolled memory layout.\nPR:L - dm_early_create() performs no capability or credential checks on its error path; unlike runtime DM_DEV_CREATE ioctls that require CAP_SYS_ADMIN, triggering the post-swap dm_resume failure only needs crafting dm-mod.create table parameters at boot, not real-root dm-ioctl privileges unobtainable via user namespaces.\nUI:N - The vulnerable teardown runs automatically during late_initcall once dm-mod.create is present and dm_resume fails; no victim must open files, mount filesystems, or take any interactive action beyond rebooting with the crafted boot configuration.\nS:U - The use-after-free and double-free corrupt kernel heap memory during device-mapper early boot setup within the kernel trust boundary; it does not cross VM, container, or IOMMU isolation boundaries into another security authority.\nC:H - dm_table_destroy() frees a dm_table still referenced through md-\u003emap after dm_swap_table(), creating a kernel heap use-after-free that can expose freed object contents and adjacent kernel memory to subsequent allocations and readers.\nI:H - UAF on the live dm_table enables heap grooming and corrupts destructor paths invoked during erroneous teardown (dm_table_destroy target dtr hooks, then dm_destroy __unbind), providing memory corruption primitives developable into arbitrary kernel writes or control-flow hijack.\nA:H - Freeing the active table then calling dm_destroy()/__unbind() on the same object causes double-free/use-after-free during boot cleanup, readily producing kernel panics, oopses, or unbootable systems on dm-mod.create rootfs platforms (Android/ChromeOS/embedded)."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:40:16.779Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3ba377a47a093cc19647ca7f102acd33a211d472"
        },
        {
          "url": "https://git.kernel.org/stable/c/72c3283a2abd60ecef295e02270f22ef1dfccd25"
        },
        {
          "url": "https://git.kernel.org/stable/c/d6066145347e14db84c35b445e309f095d0d8125"
        },
        {
          "url": "https://git.kernel.org/stable/c/259ce9e3fc3a3f8c4e393a2072b8f34302eb4d5a"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f6500d44a912d4aed664600966706d76b81d9af"
        },
        {
          "url": "https://git.kernel.org/stable/c/92e3c93d60be1f2425738cd66dbadac7d6bc0cd1"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d8ed7cb844df21e4d93af11250fb3a5cb861147"
        },
        {
          "url": "https://git.kernel.org/stable/c/366665416f20527ff7cad548a32d1ddf23195740"
        }
      ],
      "title": "dm_early_create: fix freeing used table on dm_resume failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72102",
    "datePublished": "2026-08-15T05:52:46.200Z",
    "dateReserved": "2026-08-09T03:40:39.905Z",
    "dateUpdated": "2026-08-17T05:40:16.779Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72102",
      "date": "2026-09-23",
      "epss": "0.00169",
      "percentile": "0.06592"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/md/dm-ioctl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3ba377a47a093cc19647ca7f102acd33a211d472",
                    "status": "affected",
                    "version": "6bbc923dfcf57d6b97388819a7393835664c7a8e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "72c3283a2abd60ecef295e02270f22ef1dfccd25",
                    "status": "affected",
                    "version": "6bbc923dfcf57d6b97388819a7393835664c7a8e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d6066145347e14db84c35b445e309f095d0d8125",
                    "status": "affected",
                    "version": "6bbc923dfcf57d6b97388819a7393835664c7a8e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "259ce9e3fc3a3f8c4e393a2072b8f34302eb4d5a",
                    "status": "affected",
                    "version": "6bbc923dfcf57d6b97388819a7393835664c7a8e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5f6500d44a912d4aed664600966706d76b81d9af",
                    "status": "affected",
                    "version": "6bbc923dfcf57d6b97388819a7393835664c7a8e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "92e3c93d60be1f2425738cd66dbadac7d6bc0cd1",
                    "status": "affected",
                    "version": "6bbc923dfcf57d6b97388819a7393835664c7a8e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7d8ed7cb844df21e4d93af11250fb3a5cb861147",
                    "status": "affected",
                    "version": "6bbc923dfcf57d6b97388819a7393835664c7a8e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "366665416f20527ff7cad548a32d1ddf23195740",
                    "status": "affected",
                    "version": "6bbc923dfcf57d6b97388819a7393835664c7a8e",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/md/dm-ioctl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.1"
                  },
                  {
                    "lessThan": "5.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm_early_create: fix freeing used table on dm_resume failure\n\nIf dm_resume fails, the kernel attempts to free table with\ndm_table_destroy, but the table was already instantiated with\ndm_swap_table. This commit skips the call to dm_table_destroy in this\ncase."
          }
        ],
        "id": "CVE-2026-72102",
        "lastModified": "2026-08-17T06:18:09.117",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:21:24.340",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/259ce9e3fc3a3f8c4e393a2072b8f34302eb4d5a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/366665416f20527ff7cad548a32d1ddf23195740"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3ba377a47a093cc19647ca7f102acd33a211d472"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5f6500d44a912d4aed664600966706d76b81d9af"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/72c3283a2abd60ecef295e02270f22ef1dfccd25"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7d8ed7cb844df21e4d93af11250fb3a5cb861147"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/92e3c93d60be1f2425738cd66dbadac7d6bc0cd1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d6066145347e14db84c35b445e309f095d0d8125"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-17T15:01:49+00:00",
      "cve": "CVE-2026-72102",
      "id": "CVE-2026-72102",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:fixed": "612",
      "product_status:known_affected": "36",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: dm_early_create: fix freeing used table on dm_resume failure",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72102.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-19T01:50:15Z",
      "cve": "CVE-2026-72102",
      "id": "CVE-2026-72102",
      "initial_release_date": "2026-08-28T16:40:48Z",
      "product_status:known_affected": "269",
      "product_status:known_not_affected": "93",
      "product_status:recommended": "83",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72102",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72102.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.