device-mapper-persistent-data EUVD-2026-99241

Exploitation requires a local user or an automated system tool to process attacker-crafted device-mapper metadata (thin-provisioning/cache metadata) that contains an excessively large block index; the crash is triggered in the synchronous block-reading logic during that parsing. Key limiting factors: the attacker must first deliver the malicious metadata onto the host (local vector, AV:L) AND a victim must actively invoke a device-mapper-persistent-data utility against it (UI:R) - the flaw cannot be triggered remotely or without that processing step. Impact is confined to the tool terminating (A:L, C:N/I:N); there is no code execution, privilege gain, or persistent system-wide outage.

All signals converge on this being a genuinely low-priority, low-real-risk issue rather than a high-CVSS-but-overstated one - the base score itself is only 3.3 (Low). The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) describes a local, user-interaction-dependent denial of service with no confidentiality or integrity impact and only low availability impact (a single userspace tool crashing, not a system-wide outage). No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of exploitation probability or active use. The one mild tension is PR:N combined with AV:L/UI:R: an attacker needs no privileges on the vulnerable tool itself, but the attack is entirely gated on a local user or system tool being induced to parse attacker-supplied metadata, which substantially narrows realistic exploitation. CWE-190 (integer overflow) and the 'Integer Overflow'/'Denial Of Service' tags are consistent with the described arithmetic error. Bottom line: this is a self-contained crash/DoS in a metadata-checking utility, not a priority patch item outside environments that routinely process untrusted device-mapper metadata.

An attacker crafts device-mapper thin/cache metadata containing an excessively large block index and gets it onto a system (e.g., a malicious disk image, volume, or metadata dump). When a local user or an automated system tool runs a device-mapper-persistent-data utility (such as a metadata check/repair tool) against that metadata, an arithmetic overflow in the synchronous block-reading path causes the tool to panic and terminate. No public exploit was identified at time of analysis; exploitation requires local access and the victim actively processing the crafted metadata (UI:R).