CVE-2026-72107 (GCVE-0-2026-72107)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:52 – Updated: 2026-08-17 05:40
VLAI
Title
dm era: fix out-of-bounds memory access for non-zero start sector
Summary
In the Linux kernel, the following vulnerability has been resolved: dm era: fix out-of-bounds memory access for non-zero start sector dm-era tracks writes in target-relative blocks, but era_map() calculates the writeset block before applying the target offset. Tables with a non-zero start sector can therefore pass an absolute mapped-device block to metadata_current_marked(). If the absolute block is beyond the current writeset size, writeset_marked() tests past the end of the in-core bitset. KASAN reports this as a vmalloc-out-of-bounds access. Apply the target offset before calculating the era block so writeset lookups use the target-relative block number.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: eec40579d84873dfb7021eb24c50360f073237c5 , < fe94a0b14010a3c267ff9a2508afb4f27ff1c5bf (git)
Affected: eec40579d84873dfb7021eb24c50360f073237c5 , < e3ffa8e492e5cdee62d916ee3e9244ccce2b73c5 (git)
Affected: eec40579d84873dfb7021eb24c50360f073237c5 , < 9946a7176bd8c25ddd6e5f1799c54e572ee6bf0f (git)
Affected: eec40579d84873dfb7021eb24c50360f073237c5 , < 7e1822f83c5a1ee7b4a19e98edde8770a10b4c71 (git)
Affected: eec40579d84873dfb7021eb24c50360f073237c5 , < db5f9b4601f0012038e5a2628aedec2f47933380 (git)
Affected: eec40579d84873dfb7021eb24c50360f073237c5 , < 1fcb5e29dd7a5b85adb9d8b539911741d878e829 (git)
Affected: eec40579d84873dfb7021eb24c50360f073237c5 , < bafe3e720cdac38cd7ea4eb7852a8f2dbe1bbfe6 (git)
Affected: eec40579d84873dfb7021eb24c50360f073237c5 , < a868196f03c2b19418ae3d2b69e195d668a271e5 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.15
Unaffected: 0 , < 3.15 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-era-target.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fe94a0b14010a3c267ff9a2508afb4f27ff1c5bf",
              "status": "affected",
              "version": "eec40579d84873dfb7021eb24c50360f073237c5",
              "versionType": "git"
            },
            {
              "lessThan": "e3ffa8e492e5cdee62d916ee3e9244ccce2b73c5",
              "status": "affected",
              "version": "eec40579d84873dfb7021eb24c50360f073237c5",
              "versionType": "git"
            },
            {
              "lessThan": "9946a7176bd8c25ddd6e5f1799c54e572ee6bf0f",
              "status": "affected",
              "version": "eec40579d84873dfb7021eb24c50360f073237c5",
              "versionType": "git"
            },
            {
              "lessThan": "7e1822f83c5a1ee7b4a19e98edde8770a10b4c71",
              "status": "affected",
              "version": "eec40579d84873dfb7021eb24c50360f073237c5",
              "versionType": "git"
            },
            {
              "lessThan": "db5f9b4601f0012038e5a2628aedec2f47933380",
              "status": "affected",
              "version": "eec40579d84873dfb7021eb24c50360f073237c5",
              "versionType": "git"
            },
            {
              "lessThan": "1fcb5e29dd7a5b85adb9d8b539911741d878e829",
              "status": "affected",
              "version": "eec40579d84873dfb7021eb24c50360f073237c5",
              "versionType": "git"
            },
            {
              "lessThan": "bafe3e720cdac38cd7ea4eb7852a8f2dbe1bbfe6",
              "status": "affected",
              "version": "eec40579d84873dfb7021eb24c50360f073237c5",
              "versionType": "git"
            },
            {
              "lessThan": "a868196f03c2b19418ae3d2b69e195d668a271e5",
              "status": "affected",
              "version": "eec40579d84873dfb7021eb24c50360f073237c5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-era-target.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.15"
            },
            {
              "lessThan": "3.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm era: fix out-of-bounds memory access for non-zero start sector\n\ndm-era tracks writes in target-relative blocks, but era_map() calculates\nthe writeset block before applying the target offset.  Tables with a\nnon-zero start sector can therefore pass an absolute mapped-device block\nto metadata_current_marked().\n\nIf the absolute block is beyond the current writeset size,\nwriteset_marked() tests past the end of the in-core bitset.  KASAN reports\nthis as a vmalloc-out-of-bounds access.\n\nApply the target offset before calculating the era block so writeset\nlookups use the target-relative block number."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is hit in era_map() on write bios submitted to a dm-era device; on storage servers that expose dm-era-backed LUNs via iSCSI or NVMe-oF, a remote initiator\u0027s SCSI/NVMe writes traverse the network stack into dm_submit_bio() and reach the flawed writeset lookup without local shell access.\nAC:L - Once a dm-era table uses a non-zero start sector (common when mapping a partition offset), any single write I/O deterministically passes an out-of-range block index to writeset_marked()/test_bit(); no race, special heap layout, or victim state beyond that configuration is required.\nPR:L - Exploitation requires only write access to the dm-era-backed block device (filesystem, raw /dev/dm-* node, or authenticated iSCSI/NVMe-oF initiator credentials); loading the dm table needs CAP_SYS_ADMIN, but triggering the OOB read does not\u2014unprivileged local users or remote storage clients with write permission suffice.\nUI:N - Triggering the flaw requires only the attacker\u0027s own write I/O to the dm-era volume; no victim must mount a filesystem, open a file, click a link, or perform any separate interactive action beyond routine storage writes.\nS:U - The vmalloc out-of-bounds read and any resulting kernel oops or privilege escalation occur entirely within the host kernel\u0027s device-mapper/storage subsystem on the same machine; this is not a VM escape, IOMMU bypass, or other cross-security-authority boundary violation.\nC:H - writeset_marked() calls test_bit() with an attacker-influenced block index derived from the write offset; when the absolute block exceeds the writeset size this is a vmalloc out-of-bounds read that can disclose adjacent kernel heap memory, matching CNA guidance for OOB reads.\nI:H - Kernel vmalloc out-of-bounds access via test_bit() is memory corruption in a privileged context; disclosed adjacent heap contents can be used to craft follow-on arbitrary-write or control-flow hijack primitives, so integrity impact is rated High when uncertain between Low and High.\nA:H - KASAN reports this as vmalloc-out-of-bounds, and reading past the vzalloc\u0027d bitset can fault on unmapped pages or provoke a kernel oops/panic, causing immediate denial of service on storage nodes processing writes through dm-era."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:40:20.098Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fe94a0b14010a3c267ff9a2508afb4f27ff1c5bf"
        },
        {
          "url": "https://git.kernel.org/stable/c/e3ffa8e492e5cdee62d916ee3e9244ccce2b73c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/9946a7176bd8c25ddd6e5f1799c54e572ee6bf0f"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e1822f83c5a1ee7b4a19e98edde8770a10b4c71"
        },
        {
          "url": "https://git.kernel.org/stable/c/db5f9b4601f0012038e5a2628aedec2f47933380"
        },
        {
          "url": "https://git.kernel.org/stable/c/1fcb5e29dd7a5b85adb9d8b539911741d878e829"
        },
        {
          "url": "https://git.kernel.org/stable/c/bafe3e720cdac38cd7ea4eb7852a8f2dbe1bbfe6"
        },
        {
          "url": "https://git.kernel.org/stable/c/a868196f03c2b19418ae3d2b69e195d668a271e5"
        }
      ],
      "title": "dm era: fix out-of-bounds memory access for non-zero start sector",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72107",
    "datePublished": "2026-08-15T05:52:49.581Z",
    "dateReserved": "2026-08-09T03:40:39.906Z",
    "dateUpdated": "2026-08-17T05:40:20.098Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72107",
      "date": "2026-09-22",
      "epss": "0.00633",
      "percentile": "0.48962"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/md/dm-era-target.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "fe94a0b14010a3c267ff9a2508afb4f27ff1c5bf",
                    "status": "affected",
                    "version": "eec40579d84873dfb7021eb24c50360f073237c5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e3ffa8e492e5cdee62d916ee3e9244ccce2b73c5",
                    "status": "affected",
                    "version": "eec40579d84873dfb7021eb24c50360f073237c5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9946a7176bd8c25ddd6e5f1799c54e572ee6bf0f",
                    "status": "affected",
                    "version": "eec40579d84873dfb7021eb24c50360f073237c5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7e1822f83c5a1ee7b4a19e98edde8770a10b4c71",
                    "status": "affected",
                    "version": "eec40579d84873dfb7021eb24c50360f073237c5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "db5f9b4601f0012038e5a2628aedec2f47933380",
                    "status": "affected",
                    "version": "eec40579d84873dfb7021eb24c50360f073237c5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1fcb5e29dd7a5b85adb9d8b539911741d878e829",
                    "status": "affected",
                    "version": "eec40579d84873dfb7021eb24c50360f073237c5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bafe3e720cdac38cd7ea4eb7852a8f2dbe1bbfe6",
                    "status": "affected",
                    "version": "eec40579d84873dfb7021eb24c50360f073237c5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a868196f03c2b19418ae3d2b69e195d668a271e5",
                    "status": "affected",
                    "version": "eec40579d84873dfb7021eb24c50360f073237c5",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/md/dm-era-target.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.15"
                  },
                  {
                    "lessThan": "3.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm era: fix out-of-bounds memory access for non-zero start sector\n\ndm-era tracks writes in target-relative blocks, but era_map() calculates\nthe writeset block before applying the target offset.  Tables with a\nnon-zero start sector can therefore pass an absolute mapped-device block\nto metadata_current_marked().\n\nIf the absolute block is beyond the current writeset size,\nwriteset_marked() tests past the end of the in-core bitset.  KASAN reports\nthis as a vmalloc-out-of-bounds access.\n\nApply the target offset before calculating the era block so writeset\nlookups use the target-relative block number."
          }
        ],
        "id": "CVE-2026-72107",
        "lastModified": "2026-08-17T06:18:09.717",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:21:24.920",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1fcb5e29dd7a5b85adb9d8b539911741d878e829"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7e1822f83c5a1ee7b4a19e98edde8770a10b4c71"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9946a7176bd8c25ddd6e5f1799c54e572ee6bf0f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a868196f03c2b19418ae3d2b69e195d668a271e5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bafe3e720cdac38cd7ea4eb7852a8f2dbe1bbfe6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/db5f9b4601f0012038e5a2628aedec2f47933380"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e3ffa8e492e5cdee62d916ee3e9244ccce2b73c5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fe94a0b14010a3c267ff9a2508afb4f27ff1c5bf"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-17T22:16:06+00:00",
      "cve": "CVE-2026-72107",
      "id": "CVE-2026-72107",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: dm era: fix out-of-bounds memory access for non-zero start sector",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72107.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:29:39Z",
      "cve": "CVE-2026-72107",
      "id": "CVE-2026-72107",
      "initial_release_date": "2026-08-28T16:40:41Z",
      "product_status:known_affected": "356",
      "product_status:known_not_affected": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72107",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72107.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.