CVE-2026-72316

dm era: fix NULL pointer dereference in metadata_open()

State: Published
Severity: Not scored
Published: Aug 15, 2026
Updated: Aug 17, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

dm era: fix NULL pointer dereference in metadata_open()

metadata_open() returns NULL when kzalloc_obj() fails, but the caller era_ctr() only checks IS_ERR(md). Since IS_ERR(NULL) returns false, the NULL pointer is treated as a valid result and later assigned to era->md, leading to a NULL pointer dereference when the metadata is accessed.

Fix this by returning ERR_PTR(-ENOMEM) on allocation failure, consistent with dm-cache-metadata.c, dm-thin-metadata.c, and dm-clone-metadata.c which all use ERR_PTR(-ENOMEM) for the same pattern.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	eec40579d84873dfb7021eb24c50360f073237c5 to before a705e056c2f3dd067fb2ff414f0537530baa090bAffected eec40579d84873dfb7021eb24c50360f073237c5 to before bd5a80128bdfc93b1cae935a70da000b8c483e6eAffected eec40579d84873dfb7021eb24c50360f073237c5 to before 17eb2ab13edd0b06ce6f996c5fd450d7efabb2e8Affected eec40579d84873dfb7021eb24c50360f073237c5 to before 889374b8e4a60d13fe4a5a8ae3a311ca93d1a2c3Affected eec40579d84873dfb7021eb24c50360f073237c5 to before 01c49eae7c6256f2d8cc08210a2bac3ee070e43aAffected eec40579d84873dfb7021eb24c50360f073237c5 to before 14e03ecd3b1b5fc03c082b27a2f8889f8290c30eAffected eec40579d84873dfb7021eb24c50360f073237c5 to before b69ea153d30ce19ca8997eeeca1e2219fae5a29bAffected eec40579d84873dfb7021eb24c50360f073237c5 to before 9ae672606c17891d90b282e3490b817620549599Affected
LinuxLinux	3.15Affected before 3.15Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

eec40579d84873dfb7021eb24c50360f073237c5 to before a705e056c2f3dd067fb2ff414f0537530baa090bAffected
eec40579d84873dfb7021eb24c50360f073237c5 to before bd5a80128bdfc93b1cae935a70da000b8c483e6eAffected
eec40579d84873dfb7021eb24c50360f073237c5 to before 17eb2ab13edd0b06ce6f996c5fd450d7efabb2e8Affected
eec40579d84873dfb7021eb24c50360f073237c5 to before 889374b8e4a60d13fe4a5a8ae3a311ca93d1a2c3Affected
eec40579d84873dfb7021eb24c50360f073237c5 to before 01c49eae7c6256f2d8cc08210a2bac3ee070e43aAffected
eec40579d84873dfb7021eb24c50360f073237c5 to before 14e03ecd3b1b5fc03c082b27a2f8889f8290c30eAffected
eec40579d84873dfb7021eb24c50360f073237c5 to before b69ea153d30ce19ca8997eeeca1e2219fae5a29bAffected
eec40579d84873dfb7021eb24c50360f073237c5 to before 9ae672606c17891d90b282e3490b817620549599Affected

LinuxLinux

3.15Affected
before 3.15Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.