CVE-2026-72107

dm era: fix out-of-bounds memory access for non-zero start sector

State: Published
Severity: 8.8 High
Published: Aug 15, 2026
Updated: Oct 19, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

dm era: fix out-of-bounds memory access for non-zero start sector

dm-era tracks writes in target-relative blocks, but era_map() calculates the writeset block before applying the target offset. Tables with a non-zero start sector can therefore pass an absolute mapped-device block to metadata_current_marked().

If the absolute block is beyond the current writeset size, writeset_marked() tests past the end of the in-core bitset. KASAN reports this as a vmalloc-out-of-bounds access.

Apply the target offset before calculating the era block so writeset lookups use the target-relative block number.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-125 Out-of-bounds Read

Affected Products

Product	Versions
LinuxLinux	eec40579d84873dfb7021eb24c50360f073237c5 to before fe94a0b14010a3c267ff9a2508afb4f27ff1c5bfAffected eec40579d84873dfb7021eb24c50360f073237c5 to before e3ffa8e492e5cdee62d916ee3e9244ccce2b73c5Affected eec40579d84873dfb7021eb24c50360f073237c5 to before 9946a7176bd8c25ddd6e5f1799c54e572ee6bf0fAffected eec40579d84873dfb7021eb24c50360f073237c5 to before 7e1822f83c5a1ee7b4a19e98edde8770a10b4c71Affected eec40579d84873dfb7021eb24c50360f073237c5 to before db5f9b4601f0012038e5a2628aedec2f47933380Affected eec40579d84873dfb7021eb24c50360f073237c5 to before 1fcb5e29dd7a5b85adb9d8b539911741d878e829Affected eec40579d84873dfb7021eb24c50360f073237c5 to before bafe3e720cdac38cd7ea4eb7852a8f2dbe1bbfe6Affected eec40579d84873dfb7021eb24c50360f073237c5 to before a868196f03c2b19418ae3d2b69e195d668a271e5Affected
LinuxLinux	3.15Affected before 3.15Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

eec40579d84873dfb7021eb24c50360f073237c5 to before fe94a0b14010a3c267ff9a2508afb4f27ff1c5bfAffected
eec40579d84873dfb7021eb24c50360f073237c5 to before e3ffa8e492e5cdee62d916ee3e9244ccce2b73c5Affected
eec40579d84873dfb7021eb24c50360f073237c5 to before 9946a7176bd8c25ddd6e5f1799c54e572ee6bf0fAffected
eec40579d84873dfb7021eb24c50360f073237c5 to before 7e1822f83c5a1ee7b4a19e98edde8770a10b4c71Affected
eec40579d84873dfb7021eb24c50360f073237c5 to before db5f9b4601f0012038e5a2628aedec2f47933380Affected
eec40579d84873dfb7021eb24c50360f073237c5 to before 1fcb5e29dd7a5b85adb9d8b539911741d878e829Affected
eec40579d84873dfb7021eb24c50360f073237c5 to before bafe3e720cdac38cd7ea4eb7852a8f2dbe1bbfe6Affected
eec40579d84873dfb7021eb24c50360f073237c5 to before a868196f03c2b19418ae3d2b69e195d668a271e5Affected

LinuxLinux

3.15Affected
before 3.15Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.