Skip to main content

Linux Kernel DLM EUVDEUVD-2026-27688

| CVE-2026-43125 CRITICAL
Out-of-bounds Write (CWE-787)
2026-05-06 Linux GHSA-fr2c-799q-pg3x
Buffer Overflow Linux Memory Corruption
9.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Access cluster network
  2. Delivery
    Send crafted DLM message with oversized length field
  3. Exploit
    Trigger buffer overflow in dlm_search_rsb_tree
  4. Execution
    Overwrite kernel memory structures
  5. Persist
    Execute arbitrary code in kernel context
  6. Impact
    Achieve root-level system compromise

Vulnerability Assessment

Weakness
CWE
CWE-787
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the target system to have the DLM kernel module loaded and actively listening for cluster messages, which occurs only when clustered filesystems (GFS2, OCFS2) or high-availability clustering software (Pacemaker with DLM resource agent) are configured and running. Network access to DLM communication ports (typically TCP 21064) is required from the attacker's position - this is normally restricted to cluster management networks in properly configured environments. Default Linux installations do not load DLM unless explicitly configured for clustering. Attack complexity is low once these prerequisites are met, requiring no authentication or user interaction. Most vulnerable systems are enterprise HA clusters, shared storage environments, and multi-node database clusters. Standard desktop and server deployments without clustering are not vulnerable despite running affected kernel versions. Firewalls blocking external access to cluster ports or network segmentation isolating cluster traffic significantly limit exploitation.
Impact

Despite the critical CVSS 9.8 score indicating maximum severity (network vector, low complexity, no privileges, no user interaction, high confidentiality/integrity/availability impact), real-world exploitation risk appears substantially lower based on multiple converging signals. The EPSS score of 0.02% (5th percentile) suggests security researchers and threat intelligence sources have observed minimal exploitation likelihood. No CISA KEV listing exists, confirming no confirmed active exploitation. The vulnerability requires the target system to have DLM enabled and actively listening for cluster messages - DLM is primarily used in high-availability clusters (GFS2, OCFS2) and enterprise storage environments, not default installations. Most Linux systems do not load the DLM kernel module unless explicitly configured for clustering. Attack complexity is genuinely low once network access to DLM ports (typically TCP 21064) is achieved, but this assumes firewall rules permit external access to cluster management interfaces, which security best practices prohibit. The lack of public POC code further reduces immediate risk. Priority should be HIGH for systems running clustered filesystems or HA configurations with exposed DLM ports, but MEDIUM-LOW for standard Linux deployments where DLM is inactive. This represents a classic case where CVSS environmental metrics significantly reduce base score severity - the vulnerability is severe in vulnerable configurations but affects a narrow deployment subset.
Exploit ScenarioDerived

An attacker with network access to a Linux cluster's DLM port (TCP 21064) crafts a malicious DLM protocol message containing a resource name length field set to a value exceeding DLM_RESNAME_MAXLEN. When the target kernel processes this message via dlm_dump_rsb_name(), the unchecked length parameter is passed to dlm_search_rsb_tree(), triggering an out-of-bounds write during resource name handling. The attacker overwrites adjacent kernel memory structures with controlled data, potentially corrupting function pointers or security-critical data structures. Successful exploitation yields arbitrary code execution in kernel context, allowing complete system compromise, privilege escalation to root, or denial of service through kernel panic.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 08, 2026

Remote unauthenticated attackers can cause critical out-of-bounds writes in the Linux kernel's Distributed Lock Manager (DLM) subsystem by sending malformed network messages with unvalidated length parameters to dlm_dump_rsb_name(). When the length exceeds DLM_RESNAME_MAXLEN, dlm_search_rsb_tree() writes beyond allocated buffers, enabling arbitrary code execution, denial of service, or information disclosure. Patches available for kernel versions 6.12.75, 6.18.16, 6.19.6, and 7.0. EPSS exploitation probability is very low (0.02%, 5th percentile), and no public exploit or active exploitation has been identified at time of analysis, despite the critical CVSS 9.8 score.

RemediationAI

Upgrade to patched kernel versions: 6.12.75, 6.18.16, 6.19.6, or 7.0 or later, depending on your distribution's kernel branch. Distribution-specific updates should be applied through standard package management (yum/dnf for RHEL/CentOS, apt for Debian/Ubuntu, zypper for SUSE). Kernel updates require system reboot to take effect. Patch commit references are available at https://git.kernel.org/stable/c/67288113c5e6cf9e659b4065c0ed6f16100e0c71 and related stable branch commits. For systems where immediate patching is not feasible, implement compensating controls: disable the DLM kernel module (modprobe -r dlm) if clustering functionality is not required, though this will break clustered filesystem operations; restrict network access to DLM ports (TCP 21064 default) using firewall rules to allow only trusted cluster node IP addresses, which reduces attack surface but does not eliminate risk from compromised cluster members; isolate cluster management networks on dedicated VLANs without internet connectivity. Note that disabling DLM will cause clustered filesystems to fail and should only be done on non-clustered systems. Network isolation is the most practical temporary mitigation for production clusters pending maintenance windows.

Affected VersionsENISA

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <5f053a2e7209d326cbbc07738fa6d6893d307438
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <082083c9fbd99422a0370fe2102144a231c9f5d6
Linux patch: 6.12.75
Linux patch: 6.19.6
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <67288113c5e6cf9e659b4065c0ed6f16100e0c71
Linux patch: 6.18.16
Linux patch: 7.0
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <080e5563f878c64e697b89e7439d730d0daad882

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The Distributed Lock Manager (DLM) in the Linux kernel coordinates cluster-wide resource locking across networked nodes. The vulnerability exists in dlm_search_rsb_tree(), a function that searches the resource name tree structure. The function receives a length parameter from dlm_dump_rsb_name() that originates from untrusted network messages. Without input validation, an attacker-controlled length value exceeding DLM_RESNAME_MAXLEN (the maximum resource name length constant) triggers a classic buffer overflow (CWE-120 class). This occurs during resource name copying or comparison operations where the kernel writes beyond the allocated buffer boundaries. The DLM subsystem processes network messages without requiring prior authentication, making this a network-reachable attack surface. The affected code path has existed since the initial DLM implementation (commit 1da177e4c3f4), indicating a long-standing issue across nearly all kernel versions supporting DLM functionality.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SUSE CRITICAL
Red Hat 7.0 HIGH

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
CVSS changed
May 08, 2026 - 13:22 NVD
9.8 (CRITICAL)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:27 nvd
CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

dlm: validate length in dlm_search_rsb_tree

The len parameter in dlm_dump_rsb_name() is not validated and comes from network messages. When it exceeds DLM_RESNAME_MAXLEN, it can cause out-of-bounds write in dlm_search_rsb_tree().

Add length validation to prevent potential buffer overflow.

Executive ViewAI

Why It Matters

CVE-2026-43125 is a critical remote code execution vulnerability in the Linux kernel's Distributed Lock Manager that allows unauthenticated attackers to execute arbitrary code or cause denial of service through malformed network messages. Organizations operating Linux systems with DLM enabled are at risk of complete system compromise, though current exploitation probability remains extremely low. Immediate patching of affected kernel versions is required to eliminate this high-severity attack surface.

Business Impact: High
Compensating Controls

Apply vendor patch. Until patches are deployed, restrict network access to systems with DLM enabled at the network perimeter level; disable DLM if not operationally required; monitor kernel logs for dlm_dump_rsb_name() errors or buffer anomalies as potential exploitation indicators.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-43125 ADVISORY https://ubuntu.com/security/notices/USN-8490-1 ADVISORY https://vuldb.com/vuln/361433 REF https://access.redhat.com/errata/RHSA-2026:25120 REF https://access.redhat.com/errata/RHSA-2026:25121 REF https://access.redhat.com/errata/RHSA-2026:25217 REF https://access.redhat.com/errata/RHSA-2026:33899 REF https://access.redhat.com/errata/RHSA-2026:33900 REF https://access.redhat.com/errata/RHSA-2026:34094 REF https://access.redhat.com/errata/RHSA-2026:34095 REF https://access.redhat.com/errata/RHSA-2026:35844 REF https://access.redhat.com/errata/RHSA-2026:35863 REF https://access.redhat.com/errata/RHSA-2026:36767 REF https://access.redhat.com/errata/RHSA-2026:41236 REF https://access.redhat.com/errata/RHSA-2026:55761 REF https://access.redhat.com/errata/RHSA-2026:55762 REF https://access.redhat.com/errata/RHSA-2026:55763 REF https://access.redhat.com/errata/RHSA-2026:55837 REF https://access.redhat.com/errata/RHSA-2026:56224 REF https://access.redhat.com/errata/RHSA-2026:56225 REF https://access.redhat.com/errata/RHSA-2026:59091 REF https://access.redhat.com/security/cve/CVE-2026-43125 REF https://bugzilla.redhat.com/show_bug.cgi?id=2467234 REF https://git.kernel.org/stable/c/0270664871616eb3a5c864b9aa17be76fd35b920 REF https://git.kernel.org/stable/c/080e5563f878c64e697b89e7439d730d0daad882 REF https://git.kernel.org/stable/c/082083c9fbd99422a0370fe2102144a231c9f5d6 REF https://git.kernel.org/stable/c/2deafd015ea9a0e75ee5764e20eb1e16bd73efd8 REF https://git.kernel.org/stable/c/5f053a2e7209d326cbbc07738fa6d6893d307438 REF https://git.kernel.org/stable/c/67288113c5e6cf9e659b4065c0ed6f16100e0c71 REF https://git.kernel.org/stable/c/c98d071a1ca903b705316225e47006aaa20e989c REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43125.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy