CVE-2026-72107 - Vulnerability Details

- dm era: fix out-of-bounds memory access for non-zero start sector

Description

In the Linux kernel, the following vulnerability has been resolved:

dm era: fix out-of-bounds memory access for non-zero start sector

dm-era tracks writes in target-relative blocks, but era_map() calculates
the writeset block before applying the target offset. Tables with a
non-zero start sector can therefore pass an absolute mapped-device block
to metadata_current_marked().

If the absolute block is beyond the current writeset size,
writeset_marked() tests past the end of the in-core bitset. KASAN reports
this as a vmalloc-out-of-bounds access.

Apply the target offset before calculating the era block so writeset
lookups use the target-relative block number.

Published: 2026-08-15

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`eec40579d84873dfb7021eb24c50360f073237c5`	affected	< fe94a0b14010a3c267ff9a2508afb4f27ff1c5bf
`eec40579d84873dfb7021eb24c50360f073237c5`	affected	< e3ffa8e492e5cdee62d916ee3e9244ccce2b73c5
`eec40579d84873dfb7021eb24c50360f073237c5`	affected	< 9946a7176bd8c25ddd6e5f1799c54e572ee6bf0f
`eec40579d84873dfb7021eb24c50360f073237c5`	affected	< 7e1822f83c5a1ee7b4a19e98edde8770a10b4c71
`eec40579d84873dfb7021eb24c50360f073237c5`	affected	< db5f9b4601f0012038e5a2628aedec2f47933380
`eec40579d84873dfb7021eb24c50360f073237c5`	affected	< 1fcb5e29dd7a5b85adb9d8b539911741d878e829
`eec40579d84873dfb7021eb24c50360f073237c5`	affected	< bafe3e720cdac38cd7ea4eb7852a8f2dbe1bbfe6
`eec40579d84873dfb7021eb24c50360f073237c5`	affected	< a868196f03c2b19418ae3d2b69e195d668a271e5

Linux

affected

Version	Status	Constraints
`3.15`	affected	—
`0`	unaffected	< 3.15
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2-rc3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[eec40579d84873dfb7021eb24c50360f073237c5,fe94a0b14010a3c267ff9a2508afb4f27ff1c5bf)`	affected	code_commit	—
`[eec40579d84873dfb7021eb24c50360f073237c5,e3ffa8e492e5cdee62d916ee3e9244ccce2b73c5)`	affected	code_commit	—
`[eec40579d84873dfb7021eb24c50360f073237c5,9946a7176bd8c25ddd6e5f1799c54e572ee6bf0f)`	affected	code_commit	—
`[eec40579d84873dfb7021eb24c50360f073237c5,7e1822f83c5a1ee7b4a19e98edde8770a10b4c71)`	affected	code_commit	—
`[eec40579d84873dfb7021eb24c50360f073237c5,db5f9b4601f0012038e5a2628aedec2f47933380)`	affected	code_commit	—
`[eec40579d84873dfb7021eb24c50360f073237c5,1fcb5e29dd7a5b85adb9d8b539911741d878e829)`	affected	code_commit	—
`[eec40579d84873dfb7021eb24c50360f073237c5,bafe3e720cdac38cd7ea4eb7852a8f2dbe1bbfe6)`	affected	code_commit	—
`[eec40579d84873dfb7021eb24c50360f073237c5,a868196f03c2b19418ae3d2b69e195d668a271e5)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.15`	affected	generic	—
`[0,3.15)`	unaffected	semver	—
`[5.10.261,5.10.*]`	unaffected	generic	—
`[5.15.212,5.15.*]`	unaffected	generic	—
`[6.1.178,6.1.*]`	unaffected	generic	—
`[6.6.145,6.6.*]`	unaffected	generic	—
`[6.12.97,6.12.*]`	unaffected	generic	—
`[6.18.40,6.18.*]`	unaffected	generic	—
`[7.1.5,7.1.*]`	unaffected	generic	—
`[7.2-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0022.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1fcb5e29dd7a5b85adb9d8b539911741d878e829
https://git.kernel.org/stable/c/7e1822f83c5a1ee7b4a19e98edde8770a10b4c71
https://git.kernel.org/stable/c/9946a7176bd8c25ddd6e5f1799c54e572ee6bf0f
https://git.kernel.org/stable/c/a868196f03c2b19418ae3d2b69e195d668a271e5
https://git.kernel.org/stable/c/bafe3e720cdac38cd7ea4eb7852a8f2dbe1bbfe6
https://git.kernel.org/stable/c/db5f9b4601f0012038e5a2628aedec2f47933380
https://git.kernel.org/stable/c/e3ffa8e492e5cdee62d916ee3e9244ccce2b73c5
https://git.kernel.org/stable/c/fe94a0b14010a3c267ff9a2508afb4f27ff1c5bf

History

Sat, 15 Aug 2026 20:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-120

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: dm era: fix out-of-bounds memory access for non-zero start sector dm-era tracks writes in target-relative blocks, but era_map() calculates the writeset block before applying the target offset. Tables with a non-zero start sector can therefore pass an absolute mapped-device block to metadata_current_marked(). If the absolute block is beyond the current writeset size, writeset_marked() tests past the end of the in-core bitset. KASAN reports this as a vmalloc-out-of-bounds access. Apply the target offset before calculating the era block so writeset lookups use the target-relative block number.
Title		dm era: fix out-of-bounds memory access for non-zero start sector
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1fcb5e29dd7a5b85adb9d8b539911741d878e829 https://git.kernel.org/stable/c/7e1822f83c5a1ee7b4a19e98edde8770a10b4c71 https://git.kernel.org/stable/c/9946a7176bd8c25ddd6e5f1799c54e572ee6bf0f https://git.kernel.org/stable/c/a868196f03c2b19418ae3d2b69e195d668a271e5 https://git.kernel.org/stable/c/bafe3e720cdac38cd7ea4eb7852a8f2dbe1bbfe6 https://git.kernel.org/stable/c/db5f9b4601f0012038e5a2628aedec2f47933380 https://git.kernel.org/stable/c/e3ffa8e492e5cdee62d916ee3e9244ccce2b73c5 https://git.kernel.org/stable/c/fe94a0b14010a3c267ff9a2508afb4f27ff1c5bf

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:52:49.581Z

Updated: 2026-08-15T05:52:49.581Z

Reserved: 2026-08-09T03:40:39.906Z

Link: CVE-2026-72107

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:21:24.920

Modified: 2026-08-15T06:21:24.920

Link: CVE-2026-72107

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-15T20:30:14Z

Weaknesses

CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object