UBUNTU-CVE-2026-72108

In the Linux kernel, the following vulnerability has been resolved: dm thin metadata: fix metadata snapshot consistency on commit failure reservemetadatasnap and releasemetadatasnap modify the superblock's heldroot directly in the blockmanager's buffer. If the subsequent metadata commit fails, th...

CVE-2026-74392

Summary of CVE-2026-74392 (Linux kernel, device-mapper): The issue involves the dm_poll_bio() callback used by stacked dm devices. The caller only knows about the dm queue and could initiate spinning polls, passing flags unchanged to the mapped clone, which may cause blk_mq_poll() to spin on a ta...

CVE-2026-74392 dm: limit target bio polling to one shot

In the Linux kernel, the following vulnerability has been resolved: dm: limit target bio polling to one shot dmpollbio is the -pollbio callback for a stacked dm device. The caller only knows about the dm queue, so it may decide to do a spinning poll if it thinks a single queue is being polled...

CVE-2026-74392 dm: limit target bio polling to one shot

In the Linux kernel, the following vulnerability has been resolved: dm: limit target bio polling to one shot dmpollbio is the -pollbio callback for a stacked dm device. The caller only knows about the dm queue, so it may decide to do a spinning poll if it thinks a single queue is being polled...

CVE-2026-72316 dm era: fix NULL pointer dereference in metadata_open()

In the Linux kernel, the following vulnerability has been resolved: dm era: fix NULL pointer dereference in metadataopen metadataopen returns NULL when kzallocobj fails, but the caller eractr only checks ISERRmd. Since ISERRNULL returns false, the NULL pointer is treated as a valid result and lat...

CVE-2026-72316

In the Linux kernel vulnerability CVE-2026-72316, the metadata_open() path used by device-mapper metadata handling returns NULL on kzalloc_obj() failure, but era_ctr() only checks IS_ERR(md). Since IS_ERR(NULL) is false, a NULL is treated as valid and later dereferenced (era->md). The fix is t...

CVE-2026-72108 dm thin metadata: fix metadata snapshot consistency on commit failure

In the Linux kernel, the following vulnerability has been resolved: dm thin metadata: fix metadata snapshot consistency on commit failure reservemetadatasnap and releasemetadatasnap modify the superblock's heldroot directly in the blockmanager's buffer. If the subsequent metadata commit fails, th...

EUVD-2026-59066

In the Linux kernel, the following vulnerability has been resolved: dm thin metadata: fix metadata snapshot consistency on commit failure reservemetadatasnap and releasemetadatasnap modify the superblock's heldroot directly in the blockmanager's buffer. If the subsequent metadata commit fails, th...

CVE-2026-72108 dm thin metadata: fix metadata snapshot consistency on commit failure

In the Linux kernel, the following vulnerability has been resolved: dm thin metadata: fix metadata snapshot consistency on commit failure reservemetadatasnap and releasemetadatasnap modify the superblock's heldroot directly in the blockmanager's buffer. If the subsequent metadata commit fails, th...

CVE-2026-72106 dm-ioctl: fix a possible overflow in list_version_get_info

In the Linux kernel, the following vulnerability has been resolved: dm-ioctl: fix a possible overflow in listversiongetinfo sizeoftt-version is 12 bytes, but the code writes 16 bytes into the output buffer - info-vers-version0, info-vers-version1, info-vers-version2 and info-vers-next. This can...

CVE-2026-72104 dm-pcache: reject option groups without values

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: reject option groups without values The pcache target parses optional arguments as name/value pairs. A table that advertises one optional argument and supplies only a recognized option name, for example "cachemode",...

CVE-2026-72103 dm: avoid leaking the caller's thread keyring via the table device file

In the Linux kernel, the following vulnerability has been resolved: dm: avoid leaking the caller's thread keyring via the table device file The refactoring in commit a28d893eb327 "md: port block device access to file" accidentally causes the caller's thread keyring to be kept alive long beyond th...

CVE-2026-72102

The CVE-2026-72102 entry concerns the Linux kernel. Affected area: dm_early_create logic related to dynamic device-mapper table handling. Root cause: when dm_resume fails, a table is freed via dm_table_destroy even though it was already instantiated with dm_swap_table, leading to a potential use-...

CVE-2026-72103

CVE-2026-72103 relates to the Linux kernel’s dm-crypt flow. A refactoring bug caused the caller’s thread keyring to be kept alive beyond the caller’s lifetime, making the LUKS volume key linger in memory. As a result, cryptsetup luksSuspend could fail to wipe the key, even though luksOpen passes ...

CVE-2026-72102 dm_early_create: fix freeing used table on dm_resume failure

In the Linux kernel, the following vulnerability has been resolved: dmearlycreate: fix freeing used table on dmresume failure If dmresume fails, the kernel attempts to free table with dmtabledestroy, but the table was already instantiated with dmswaptable. This commit skips the call to...

CVE-2026-72103 dm: avoid leaking the caller's thread keyring via the table device file

In the Linux kernel, the following vulnerability has been resolved: dm: avoid leaking the caller's thread keyring via the table device file The refactoring in commit a28d893eb327 "md: port block device access to file" accidentally causes the caller's thread keyring to be kept alive long beyond th...

CVE-2026-72102 dm_early_create: fix freeing used table on dm_resume failure

In the Linux kernel, the following vulnerability has been resolved: dmearlycreate: fix freeing used table on dmresume failure If dmresume fails, the kernel attempts to free table with dmtabledestroy, but the table was already instantiated with dmswaptable. This commit skips the call to...

EUVD-2026-59060

In the Linux kernel, the following vulnerability has been resolved: dmearlycreate: fix freeing used table on dmresume failure If dmresume fails, the kernel attempts to free table with dmtabledestroy, but the table was already instantiated with dmswaptable. This commit skips the call to...

EUVD-2026-59055

In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix a possible NULL pointer dereference Fix a possible NULL pointer dereference dmverityloadpinisbdevtrusted if the device has no table...

CVE-2026-72097 dm-verity: fix a possible NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix a possible NULL pointer dereference Fix a possible NULL pointer dereference dmverityloadpinisbdevtrusted if the device has no table...