CVE-2026-110036

Awaiting Analysis Awaiting Analysis - Queue

Denial of Service in device-mapper-persistent-data

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: redhat-SADP

Description

A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service (DoS) by inducing a user or system tool to process crafted device metadata containing an excessively large block index. An arithmetic error in the synchronous block reading logic causes the application to panic and unexpectedly terminate.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110036

EUVD

EUVD-2026-99241

Affected Vendors & Products

Vendor	Product	Version / Range
Red	Hat	Red Hat Enterprise Linux 10 *
Red	Hat	Red Hat Enterprise Linux 7 *
Red	Hat	Red Hat Enterprise Linux 8 *
Red	Hat	Red Hat OpenShift Container Platform 4 *

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

This is a Denial of Service (DoS) vulnerability in device-mapper-persistent-data where a local attacker can cause a crash by providing crafted device metadata with an excessively large block index. The issue involves an integer overflow in the synchronous block reading logic, leading to an invalid range that triggers a panic and process termination.

Detection Guidance

Monitor for crashes or panics in device-mapper-persistent-data tools when processing metadata. Check logs for errors in functions like find_runs or VectoredBlockIo::read_blocks. Validate block indices in metadata before processing to detect excessively large values.

Impact Analysis

The vulnerability can cause the affected application to crash, disrupting services that rely on device-mapper-persistent-data. Since exploitation requires local access and crafted metadata, the impact is limited to systems processing untrusted input, typically during administrative tasks.

Mitigation Strategies

Avoid processing untrusted metadata or images with device-mapper-persistent-data tools. Validate block indices in metadata to ensure they are within expected ranges before use. Monitor for crashes in affected tools as a potential sign of exploitation.

Hi! I’m here to help you understand CVE-2026-110036. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70