{"id":"CVE-2026-72107","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-72107","summary":"dm era: fix out-of-bounds memory access for non-zero start sector","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm era: fix out-of-bounds memory access for non-zero start sector\n\ndm-era tracks writes in target-relative blocks, but era_map() calculates\nthe writeset block before applying the target offset.  Tables with a\nnon-zero start sector can therefore pass an absolute mapped-device block\nto metadata_current_marked().\n\nIf the absolute block is beyond the current writeset size,\nwriteset_marked() tests past the end of the in-core bitset.  KASAN reports\nthis as a vmalloc-out-of-bounds access.\n\nApply the target offset before calculating the era block so writeset\nlookups use the target-relative block number.","published":"2026-08-15T05:52:49.581Z","modified":"2026-08-18T03:56:20.582279648Z","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Linux","name":"Kernel","fixedVersion":"5.10.261"}],"fix":null,"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/1fcb5e29dd7a5b85adb9d8b539911741d878e829"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7e1822f83c5a1ee7b4a19e98edde8770a10b4c71"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9946a7176bd8c25ddd6e5f1799c54e572ee6bf0f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a868196f03c2b19418ae3d2b69e195d668a271e5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/bafe3e720cdac38cd7ea4eb7852a8f2dbe1bbfe6"},{"type":"WEB","url":"https://git.kernel.org/stable/c/db5f9b4601f0012038e5a2628aedec2f47933380"},{"type":"WEB","url":"https://git.kernel.org/stable/c/e3ffa8e492e5cdee62d916ee3e9244ccce2b73c5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/fe94a0b14010a3c267ff9a2508afb4f27ff1c5bf"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72107.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72107"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-18T03:56:20.582279648Z"}}