Skip to main content

Linux Kernel EUVDEUVD-2026-27692

| CVE-2026-43132 MEDIUM
2026-05-06 Linux GHSA-xwqw-f775-g672
Denial Of Service Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
May 08, 2026 - 20:01 vuln.today
CVSS changed
May 08, 2026 - 17:37 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:27 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

dm-verity: correctly handle dm_bufio_client_create() failure

If either of the calls to dm_bufio_client_create() in verity_fec_ctr() fails, then dm_bufio_client_destroy() is later called with an ERR_PTR() argument. That causes a crash. Fix this.

AnalysisAI

Denial of service in Linux kernel dm-verity subsystem allows local authenticated users to crash the system by triggering dm_bufio_client_create() failure in verity_fec_ctr(), which incorrectly passes an error pointer to dm_bufio_client_destroy(). The vulnerability requires local access and authenticated privileges but no user interaction, affecting dm-verity configurations with forward error correction enabled.

Technical ContextAI

The vulnerability exists in the device-mapper verity module's forward error correction (FEC) initialization code (verity_fec_ctr() function). When dm_bufio_client_create() returns an error pointer (ERR_PTR) due to memory allocation or initialization failure, the error handling code incorrectly calls dm_bufio_client_destroy() with that error pointer as an argument. The dm_bufio_client_destroy() function expects a valid pointer and dereferences it, causing a kernel null pointer dereference or memory access violation. This is a resource management error in kernel space affecting the dm-verity integrity verification subsystem used in container and filesystem security contexts.

RemediationAI

Apply the latest stable kernel patch for your branch: Linux 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, or 7.0 depending on your kernel version. The fix is available in upstream commits 6283e49af87a9c121bb01e5a64a7fe5706c210bc and related backports referenced at https://git.kernel.org/stable/. Users should compile and deploy the patched kernel version immediately after testing in a non-production environment. If immediate patching is not possible, disable dm-verity FEC functionality by removing the fec_dev option from dm-verity mount configurations, though this reduces integrity verification capabilities for error correction; verify your use case permits this trade-off before implementing.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-27692 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy