Skip to main content

Linux Kernel CVE-2026-72102

| EUVDEUVD-2026-59060 HIGH
2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-9cpr-x8vv-xjrp
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.4 MEDIUM

DM control-plane operations require CAP_SYS_ADMIN in standard configurations (PR:H); triggering dm_resume failure after dm_swap_table is a non-default error path requiring specific conditions (AC:H).

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.1 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 06:50 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 06:21 cve.org
HIGH 7.8
CVE Published
Aug 15, 2026 - 06:21 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

dm_early_create: fix freeing used table on dm_resume failure

If dm_resume fails, the kernel attempts to free table with dm_table_destroy, but the table was already instantiated with dm_swap_table. This commit skips the call to dm_table_destroy in this case.

AnalysisAI

Double-free memory corruption in the Linux kernel's device mapper subsystem allows a local attacker to trigger kernel memory corruption by causing dm_resume failure during early device creation, potentially leading to privilege escalation or system crash. Affected systems run kernel versions from approximately Linux 5.1 through multiple stable branches prior to the respective patch commits; fixes are available across all major stable series from 5.10 through 7.2-rc3. No public exploit code exists and EPSS exploitation probability is extremely low at 0.22% (13th percentile), though the high CVSS impact metrics (C:H/I:H/A:H) reflect the potential severity if the error path is successfully triggered and weaponized.

Technical ContextAI

The vulnerability resides in the dm_early_create function within the Linux kernel's device mapper (DM) subsystem - a kernel framework providing a generic mechanism for creating virtual block device layers used by LVM2, software RAID, dm-crypt encryption, and other storage abstractions. The defect is an error-handling logic flaw: when dm_resume fails after dm_swap_table has already been called and transferred table ownership, the error recovery path incorrectly invokes dm_table_destroy on the same table object - one that is no longer owned by dm_early_create. This constitutes a double-free or use-after-free condition in which the table's memory may be freed twice or accessed after deallocation. CWE is listed as N/A in available data, but this pattern is structurally consistent with CWE-415 (Double Free) or CWE-416 (Use After Free). The provided CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms a local attack vector with stated low-privilege threshold, though DM control plane operations have historically required elevated kernel capabilities such as CAP_SYS_ADMIN.

RemediationAI

Upgrade the Linux kernel to a patched stable version appropriate to the deployed branch: 5.10.261 or later (5.10 series), 5.15.212 or later (5.15 series), 6.1.178 or later (6.1 LTS series), 6.6.145 or later (6.6 LTS series), 6.12.97 or later (6.12 series), 6.18.40 or later (6.18 series), 7.1.5 or later (7.1 series), or 7.2-rc3 and later for the 7.2 development branch. Stable patch commits are available at https://git.kernel.org/stable/. Distributions shipping custom kernels - RHEL, Ubuntu, Debian, SUSE, and others - should consult their respective vendor security advisories for backported fixes rather than applying upstream commits directly. As a pre-patch compensating control, enforcing mandatory access control policies via SELinux or AppArmor to restrict device mapper administrative operations to explicitly authorized administrative roles would reduce the effective attack surface; note that overly broad restrictions on DM operations may disrupt legitimate LVM2, dm-crypt, or multipath storage management workflows and should be tested before deployment.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72102 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy