Skip to main content

Linux Kernel CVE-2026-72098

| EUVDEUVD-2026-59056 CRITICAL
2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-h569-8r6w-7rvq
Buffer Overflow Linux Red Hat Suse
9.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.3 MEDIUM

Requires local ability to plant precisely crafted corruption on a FEC-enabled verity device, so AV:L/AC:H/PR:L; impact is kernel memory corruption (integrity/availability), no direct confidentiality disclosure.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.8 HIGH
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 06:47 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
9.8 (CRITICAL)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 06:21 cve.org
CRITICAL 9.8
CVE Published
Aug 15, 2026 - 06:21 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

dm-verity: fix buffer overflow in FEC calculation

There's a buffer overflow in dm-verity-fec:

if (neras && *neras <= v->fec->roots) fio->erasures[(*neras)++] = i;

This allows *neras to reach roots + 1 (the post-increment pushes it past roots). This value is then passed as no_eras to decode_rs8(). Inside the RS decoder (lib/reed_solomon/decode_rs.c:113-121), the erasure locator polynomial loop writes lambda[j] where j can reach nroots + 1 - one element past the end of lambda[] (which is sized nroots + 1, valid indices 0..nroots). The out-of-bounds write lands on syn[0], corrupting the syndrome buffer.

AnalysisAI

An out-of-bounds kernel write in the Linux kernel's dm-verity Forward Error Correction (FEC) code allows corruption of adjacent kernel memory when Reed-Solomon erasure recovery is triggered. An off-by-one in the erasure-counting logic lets the erasure count reach roots+1, which is then passed to decode_rs8() and overruns the lambda[] locator polynomial by one element, clobbering the syndrome buffer (syn[0]). It affects Linux systems using dm-verity with FEC enabled; there is no CISA KEV listing, no public exploit identified, and EPSS is low (0.22%, 13th percentile), indicating this is a memory-safety defect rather than an actively exploited threat.

Technical ContextAI

dm-verity is the device-mapper target that provides transparent block-level integrity verification (verified boot / read-only rootfs integrity), and its optional FEC layer uses Reed-Solomon coding (lib/reed_solomon) to repair corrupted blocks rather than fail the read. The bug is in dm-verity-fec's erasure collection: the guard 'if (neras && *neras <= v->fec->roots) fio->erasures[(*neras)++] = i' uses '<=' with a post-increment, so *neras can become roots+1. That value flows in as no_eras to decode_rs8(); inside decode_rs.c the erasure-locator loop indexes lambda[j] up to nroots+1, one past lambda[]'s allocated size of nroots+1 (valid 0..nroots), and the stray write lands on syn[0]. This is a classic off-by-one leading to an out-of-bounds write (CWE-787-class), even though the input lists CWE as N/A.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.18.42, 7.1.5, or 7.2-rc3 (or any build containing commits 31d6e6c0, f7990c2b, or 5488d3a6 from git.kernel.org/stable) - as the primary fix. If immediate patching is not possible on a given fleet, the most direct compensating control is to disable dm-verity FEC on affected targets (drop the 'fec_roots/fec_blocks' parameters), which removes the vulnerable code path entirely at the cost of losing automatic corruption recovery so that verity will hard-fail on any block error instead of repairing it; this is acceptable where the backing storage is otherwise trusted. Where FEC must remain enabled, restrict local/physical and privileged access to the underlying block devices and dm setup so untrusted parties cannot introduce the crafted block corruption needed to trigger recovery. Track the vendor record at https://nvd.nist.gov/vuln/detail/CVE-2026-72098 for downstream distro backports.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72098 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy