Linux Kernel CVE-2026-72105

The Device Mapper log (dm-log) subsystem in the Linux kernel tracks dirty regions for mirrored block devices, typically in RAID1 configurations. The vulnerability resides in the bitset_size calculation: when region_count is valid but close to UINT_MAX, rounding it up to the nearest multiple of BITS_PER_LONG produces a value of 2^32, which overflows a 32-bit size_t to zero. The subsequent division by 8 to convert bits to bytes then yields a zero-length allocation for the dirty-region bitmap. A prior fix (commit c20e36b7631d, tagged CWE for region_count overflow) addressed the region_count field but left the derived bitset_size calculation unguarded. The fix requires special-casing a zero result after rounding to detect rollover and set bitset_size to the correct byte count for 2^32 bits. The flaw is architecturally constrained: on 64-bit systems, size_t is 64 bits and the overflow cannot occur. No CWE identifier has been officially assigned, but this is a classic integer overflow/wraparound leading to a buffer overflow, consistent with CWE-190 and CWE-787.