UBUNTU-CVE-2026-72098

In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix buffer overflow in FEC calculation There's a buffer overflow in dm-verity-fec: if neras && neras fec-roots fio-erasuresneras++ = i; This allows neras to reach roots + 1 the post-increment pushes it past roots. This...

UBUNTU-CVE-2026-72104

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: reject option groups without values The pcache target parses optional arguments as name/value pairs. A table that advertises one optional argument and supplies only a recognized option name, for example "cachemode",...

UBUNTU-CVE-2026-72106

In the Linux kernel, the following vulnerability has been resolved: dm-ioctl: fix a possible overflow in listversiongetinfo sizeoftt-version is 12 bytes, but the code writes 16 bytes into the output buffer - info-vers-version0, info-vers-version1, info-vers-version2 and info-vers-next. This can...

CVE-2026-72316 dm era: fix NULL pointer dereference in metadata_open()

In the Linux kernel, the following vulnerability has been resolved: dm era: fix NULL pointer dereference in metadataopen metadataopen returns NULL when kzallocobj fails, but the caller eractr only checks ISERRmd. Since ISERRNULL returns false, the NULL pointer is treated as a valid result and lat...

EUVD-2026-59215

In the Linux kernel, the following vulnerability has been resolved: dm era: fix NULL pointer dereference in metadataopen metadataopen returns NULL when kzallocobj fails, but the caller eractr only checks ISERRmd. Since ISERRNULL returns false, the NULL pointer is treated as a valid result and lat...

CVE-2026-72108

CVE-2026-72108 : The Linux kernel fix addresses a metadata inconsistency in dm thin metadata when a metadata snapshot commit fails. The root cause was that __reserve_metadata_snap() and __release_metadata_snap() modified the superblock’s held_root directly in the block_manager buffer, which could...

CVE-2026-72107

Summary (CVE-2026-72107) In the Linux kernel, the vulnerability is in the dm-era code path where writes are tracked in target-relative blocks. The root cause is that era_map() calculates the writeset block before applying the target offset, allowing a non-zero start sector to pass an absolute map...

EUVD-2026-59065

In the Linux kernel, the following vulnerability has been resolved: dm era: fix out-of-bounds memory access for non-zero start sector dm-era tracks writes in target-relative blocks, but eramap calculates the writeset block before applying the target offset. Tables with a non-zero start sector can...

CVE-2026-72107 dm era: fix out-of-bounds memory access for non-zero start sector

In the Linux kernel, the following vulnerability has been resolved: dm era: fix out-of-bounds memory access for non-zero start sector dm-era tracks writes in target-relative blocks, but eramap calculates the writeset block before applying the target offset. Tables with a non-zero start sector can...

CVE-2026-72107 dm era: fix out-of-bounds memory access for non-zero start sector

In the Linux kernel, the following vulnerability has been resolved: dm era: fix out-of-bounds memory access for non-zero start sector dm-era tracks writes in target-relative blocks, but eramap calculates the writeset block before applying the target offset. Tables with a non-zero start sector can...

CVE-2026-72106 dm-ioctl: fix a possible overflow in list_version_get_info

In the Linux kernel, the following vulnerability has been resolved: dm-ioctl: fix a possible overflow in listversiongetinfo sizeoftt-version is 12 bytes, but the code writes 16 bytes into the output buffer - info-vers-version0, info-vers-version1, info-vers-version2 and info-vers-next. This can...

CVE-2026-72106 dm-ioctl: fix a possible overflow in list_version_get_info

In the Linux kernel, the following vulnerability has been resolved: dm-ioctl: fix a possible overflow in listversiongetinfo sizeoftt-version is 12 bytes, but the code writes 16 bytes into the output buffer - info-vers-version0, info-vers-version1, info-vers-version2 and info-vers-next. This can...

EUVD-2026-59063

In the Linux kernel, the following vulnerability has been resolved: dm-log: fix a bitsetsize overflow on 32bit machines Commit c20e36b7631d "dm log: fix out-of-bounds write due to regioncount overflow" made sure that regioncount could fit in an unsigned int. But the bitmap memory isn't allocated...

EUVD-2026-59064

In the Linux kernel, the following vulnerability has been resolved: dm-ioctl: fix a possible overflow in listversiongetinfo sizeoftt-version is 12 bytes, but the code writes 16 bytes into the output buffer - info-vers-version0, info-vers-version1, info-vers-version2 and info-vers-next. This can...

CVE-2026-72105 dm-log: fix a bitset_size overflow on 32bit machines

In the Linux kernel, the following vulnerability has been resolved: dm-log: fix a bitsetsize overflow on 32bit machines Commit c20e36b7631d "dm log: fix out-of-bounds write due to regioncount overflow" made sure that regioncount could fit in an unsigned int. But the bitmap memory isn't allocated...

CVE-2026-72106

In the Linux kernel, the following vulnerability has been resolved: dm-ioctl: fix a possible overflow in listversiongetinfo sizeoftt-version is 12 bytes, but the code writes 16 bytes into the output buffer - info-vers-version0, info-vers-version1, info-vers-version2 and info-vers-next. This can...

CVE-2026-72105

The CVE-2026-72105 entry concerns the Linux kernel dm-log component, where a bitset_size overflow on 32‑bit architectures could occur during region_count handling. The root cause is a miscalculation of bitset_size (size_t) when computing the bitmap memory based on region_count, which could wrap t...

CVE-2026-72106

In the Linux kernel, the dm-ioctl path in list_version_get_info has a potential buffer overflow: sizeof(tt->version) is 12 bytes, but the code writes 16 bytes into the output buffer (info->vers->version[0..2] and info->vers->next). The fix replaces sizeof(tt->version) with sizeo...

CVE-2026-72105 dm-log: fix a bitset_size overflow on 32bit machines

In the Linux kernel, the following vulnerability has been resolved: dm-log: fix a bitsetsize overflow on 32bit machines Commit c20e36b7631d "dm log: fix out-of-bounds write due to regioncount overflow" made sure that regioncount could fit in an unsigned int. But the bitmap memory isn't allocated...

CVE-2026-72104

The CVE-2026-72104 entry concerns the Linux kernel component dm-pcache (pcache target). The vulnerability arises when optional arguments are parsed as name/value pairs and a table advertises an option (e.g., cache_mode) but provides only the option name; after consuming the name, the parser decre...