EUVD-2026-58594
GHSA-2f2v-c79p-8x4x
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack arrives via block-device metadata (AV:L); no target-system privileges needed to supply malicious storage (PR:N); automated LVM scans require no user action (UI:N); impact is pure availability - process crash, no data exposure (C:N/I:N/A:H).
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
3DescriptionCVE.org
A flaw was found in libdm. A remote attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the metadata to crash. This vulnerability results in a Denial of Service (DoS) for affected systems.
AnalysisAI
Stack exhaustion in libdm's LVM metadata configuration parser allows any LVM command processing attacker-crafted block device metadata to crash, resulting in denial of service on affected Linux systems. The flaw is exploitable in shared storage, SAN, or virtualization environments where an adversary can supply a maliciously structured block device to a target system running LVM2. No public exploit code has been identified at time of analysis, and the vulnerability is absent from CISA KEV; however, the provided CVSS vector is materially inconsistent with the described DoS impact and warrants independent verification.
Technical ContextAI
libdm is the device-mapper userspace library underpinning the Linux Logical Volume Manager (LVM2) stack, responsible for parsing and interpreting LVM metadata stored on physical block devices. Metadata is encoded in a hierarchical, brace-delimited configuration format that the parser traverses recursively. The root cause maps to CWE-770 (Allocation of Resources Without Limits or Throttling): the parser imposes no depth ceiling on recursive descent, so artificially deep nesting exhausts process stack space before completing. Any LVM utility - vgscan, pvscan, lvs, vgs, lvcreate, and others - that invokes this parser against attacker-controlled metadata is affected. No CPE strings were provided in the source data, but given the reporter (secalert@redhat.com), the lvm2 and device-mapper packages in Red Hat Enterprise Linux and its derivatives are the primary confirmed scope.
RemediationAI
Monitor the Red Hat Security Advisory at https://access.redhat.com/security/cve/CVE-2026-19617 for patched lvm2/device-mapper package versions; apply updates via dnf update lvm2 device-mapper once a patched release is published. No specific fix version has been independently confirmed from the available data. As a compensating control, configure lvm.conf to restrict device scanning to known-safe devices using the devices/filter directive (e.g., filter = [ 'a|/dev/sda.*|', 'r|.*|' ]), which prevents the parser from processing metadata on unknown or externally supplied block devices - note this may break LVM discovery of newly attached legitimate storage and requires careful testing before production deployment. In virtualization and cloud environments, enforce strict controls over which users and services can attach block devices to guest VMs to prevent unauthorized storage presentation. In SAN environments, enforce LUN masking and FC/iSCSI zoning to limit which initiators can present storage to target hosts.
More in Enterprise Linux
View allIn PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.4
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected
Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb7
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
Sudo before 1.9.17p1 contains a local root escalation vulnerability (CVE-2025-32463, CVSS 9.3) through the --chroot opti
Same technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today