CVE-2026-72108

CVE-2026-72108 : The Linux kernel fix addresses a metadata inconsistency in dm thin metadata when a metadata snapshot commit fails. The root cause was that __reserve_metadata_snap() and __release_metadata_snap() modified the superblock’s held_root directly in the block_manager buffer, which could...

CVE-2026-72107 dm era: fix out-of-bounds memory access for non-zero start sector

In the Linux kernel, the following vulnerability has been resolved: dm era: fix out-of-bounds memory access for non-zero start sector dm-era tracks writes in target-relative blocks, but eramap calculates the writeset block before applying the target offset. Tables with a non-zero start sector can...

EUVD-2026-59065

In the Linux kernel, the following vulnerability has been resolved: dm era: fix out-of-bounds memory access for non-zero start sector dm-era tracks writes in target-relative blocks, but eramap calculates the writeset block before applying the target offset. Tables with a non-zero start sector can...

CVE-2026-72107

Summary (CVE-2026-72107) In the Linux kernel, the vulnerability is in the dm-era code path where writes are tracked in target-relative blocks. The root cause is that era_map() calculates the writeset block before applying the target offset, allowing a non-zero start sector to pass an absolute map...

CVE-2026-72107 dm era: fix out-of-bounds memory access for non-zero start sector

In the Linux kernel, the following vulnerability has been resolved: dm era: fix out-of-bounds memory access for non-zero start sector dm-era tracks writes in target-relative blocks, but eramap calculates the writeset block before applying the target offset. Tables with a non-zero start sector can...

CVE-2026-72106 dm-ioctl: fix a possible overflow in list_version_get_info

In the Linux kernel, the following vulnerability has been resolved: dm-ioctl: fix a possible overflow in listversiongetinfo sizeoftt-version is 12 bytes, but the code writes 16 bytes into the output buffer - info-vers-version0, info-vers-version1, info-vers-version2 and info-vers-next. This can...

EUVD-2026-59063

In the Linux kernel, the following vulnerability has been resolved: dm-log: fix a bitsetsize overflow on 32bit machines Commit c20e36b7631d "dm log: fix out-of-bounds write due to regioncount overflow" made sure that regioncount could fit in an unsigned int. But the bitmap memory isn't allocated...

CVE-2026-72106 dm-ioctl: fix a possible overflow in list_version_get_info

In the Linux kernel, the following vulnerability has been resolved: dm-ioctl: fix a possible overflow in listversiongetinfo sizeoftt-version is 12 bytes, but the code writes 16 bytes into the output buffer - info-vers-version0, info-vers-version1, info-vers-version2 and info-vers-next. This can...

CVE-2026-72106

In the Linux kernel, the following vulnerability has been resolved: dm-ioctl: fix a possible overflow in listversiongetinfo sizeoftt-version is 12 bytes, but the code writes 16 bytes into the output buffer - info-vers-version0, info-vers-version1, info-vers-version2 and info-vers-next. This can...

CVE-2026-72106

In the Linux kernel, the dm-ioctl path in list_version_get_info has a potential buffer overflow: sizeof(tt->version) is 12 bytes, but the code writes 16 bytes into the output buffer (info->vers->version[0..2] and info->vers->next). The fix replaces sizeof(tt->version) with sizeo...

EUVD-2026-59064

In the Linux kernel, the following vulnerability has been resolved: dm-ioctl: fix a possible overflow in listversiongetinfo sizeoftt-version is 12 bytes, but the code writes 16 bytes into the output buffer - info-vers-version0, info-vers-version1, info-vers-version2 and info-vers-next. This can...

CVE-2026-72105 dm-log: fix a bitset_size overflow on 32bit machines

In the Linux kernel, the following vulnerability has been resolved: dm-log: fix a bitsetsize overflow on 32bit machines Commit c20e36b7631d "dm log: fix out-of-bounds write due to regioncount overflow" made sure that regioncount could fit in an unsigned int. But the bitmap memory isn't allocated...

CVE-2026-72105

The CVE-2026-72105 entry concerns the Linux kernel dm-log component, where a bitset_size overflow on 32‑bit architectures could occur during region_count handling. The root cause is a miscalculation of bitset_size (size_t) when computing the bitmap memory based on region_count, which could wrap t...

CVE-2026-72105 dm-log: fix a bitset_size overflow on 32bit machines

In the Linux kernel, the following vulnerability has been resolved: dm-log: fix a bitsetsize overflow on 32bit machines Commit c20e36b7631d "dm log: fix out-of-bounds write due to regioncount overflow" made sure that regioncount could fit in an unsigned int. But the bitmap memory isn't allocated...

CVE-2026-72104 dm-pcache: reject option groups without values

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: reject option groups without values The pcache target parses optional arguments as name/value pairs. A table that advertises one optional argument and supplies only a recognized option name, for example "cachemode",...

EUVD-2026-59062

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: reject option groups without values The pcache target parses optional arguments as name/value pairs. A table that advertises one optional argument and supplies only a recognized option name, for example "cachemode",...

CVE-2026-72104 dm-pcache: reject option groups without values

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: reject option groups without values The pcache target parses optional arguments as name/value pairs. A table that advertises one optional argument and supplies only a recognized option name, for example "cachemode",...

CVE-2026-72104

The CVE-2026-72104 entry concerns the Linux kernel component dm-pcache (pcache target). The vulnerability arises when optional arguments are parsed as name/value pairs and a table advertises an option (e.g., cache_mode) but provides only the option name; after consuming the name, the parser decre...

EUVD-2026-59061

In the Linux kernel, the following vulnerability has been resolved: dm: avoid leaking the caller's thread keyring via the table device file The refactoring in commit a28d893eb327 "md: port block device access to file" accidentally causes the caller's thread keyring to be kept alive long beyond th...

EUVD-2026-59059

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix leaking uninitialized kernel memory If hash size is less than device's tuple size, dm-integrity is supposed to zero the remaining space. There was a bug in the code that zeroing didn't work. This commit fixes it...