Linux Kernel CVE-2026-72098

Exploitation requires a dm-verity target explicitly configured with FEC (Reed-Solomon, fec_roots set) - a non-default option used mainly in verified-boot/embedded and Android-style deployments - and the attacker must be able to introduce crafted corruption into the underlying data or FEC blocks such that the erasure count collected in dm-verity-fec reaches roots+1, forcing the decode_rs8() erasure path. Limiting factors: the FEC feature must be enabled (many dm-verity users run without it), the corruption must be precisely shaped to reach the off-by-one boundary rather than simply fail verification, and the attacker needs local access to the backing storage to plant it; there is no evidence of remote, unauthenticated triggering despite the AV:N in the supplied CVSS vector.

The supplied CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) substantially overstates real-world risk and conflicts with the technical facts: the FEC decode path is only reached when a dm-verity target has FEC configured AND underlying data blocks are corrupted enough to invoke recovery, which is not a remote, network-reachable, unauthenticated primitive against a default configuration. EPSS (0.22%, 13th percentile) and the absence of any CISA KEV entry or public PoC all point to low practical exploitation likelihood, and the corruption is a single-element OOB write onto a specific adjacent buffer rather than a broadly controllable overflow, so weaponization into reliable code execution is non-trivial. That said, it is genuine kernel memory corruption with denial-of-service and potential privilege-escalation implications on affected builds, so an operator running FEC-enabled dm-verity (for example verified-boot Android/embedded fleets, where a mid-sized deployment might have thousands of identical devices) should still patch promptly. Bottom line: patch on the normal stable-kernel cadence, but treat the 9.8 as a scoring artifact - the network vector in particular is not supported by the description and should be reconciled with the vendor.

An attacker with the ability to write corrupted data to the block device backing a FEC-enabled dm-verity target crafts corruption that produces just enough erasures to push the erasure count to roots+1; when the kernel reads those blocks and invokes FEC recovery, the Reed-Solomon decoder performs a one-element out-of-bounds write into the syndrome buffer, corrupting kernel memory to cause a crash or potentially escalate privileges. No public exploit code has been identified, and given AC and the need to control on-disk corruption the attack is non-trivial and local in nature.