CVE-2026-72014

Received Received - Intake

DRBD Peer Data Reply Payload Size Validation Flaw

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drbd: reject data replies with an out-of-range payload size recv_dless_read() receives a P_DATA_REPLY from a peer into the bio of an outstanding read request. The peer-supplied payload length reaches it as the signed int data_size, and two peer-controlled inputs can make it negative. With a negotiated data-integrity-alg the digest length is subtracted first, so a reply whose payload is smaller than the digest underflows data_size. With no integrity algorithm (the default) data_size is assigned from the unsigned h95/h100 wire length and drbdd() never bounds it for a payload-carrying command, so a length above INT_MAX casts it negative; this path needs no non-default feature. The bio receive loop then computes expect = min_t(int, data_size, bv_len), which is negative, and drbd_recv_all_warn(mapped, expect) receives with a size_t of SIZE_MAX into the first mapped page. The sibling receive path read_in_block() is not affected: it uses an unsigned size and rejects it against DRBD_MAX_BIO_SIZE before receiving. Reject a data reply whose size is negative after the optional digest subtraction, covering both triggers. Impact: a malicious or man-in-the-middle DRBD peer copies attacker-chosen bytes past a bio page in the receiver, corrupting kernel memory. A node that reads from its peer (a diskless node, or read-balancing to the peer) is exposed in the default configuration; data-integrity-alg is not required.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72014

EUVD

EUVD-2026-59113

Affected Vendors & Products

Vendor	Product	Version / Range
linbit	drbd	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the DRBD (Distributed Replicated Block Device) module. A peer can send a malicious data reply with a payload size that underflows or overflows, causing the receiver to process a negative size. This leads to memory corruption as attacker-chosen bytes are copied past a bio page in the kernel.

Detection Guidance

This vulnerability can be detected by monitoring DRBD traffic for malformed P_DATA_REPLY packets with negative payload sizes. Check kernel logs for memory corruption errors or unexpected bio page writes. Use tcpdump or Wireshark to inspect DRBD protocol traffic for payload sizes exceeding INT_MAX or smaller than digest lengths.

Impact Analysis

If you use DRBD in your system, especially in configurations where a node reads from its peer (like diskless nodes or read-balancing setups), this vulnerability could allow a malicious peer or man-in-the-middle attacker to corrupt kernel memory. This may lead to system crashes, data corruption, or potential privilege escalation.

Compliance Impact

This vulnerability allows a malicious peer to corrupt kernel memory by copying attacker-chosen bytes past a bio page in the receiver. This could lead to unauthorized data access, modification, or denial of service, which may violate GDPR's integrity and confidentiality requirements or HIPAA's security rule for protecting electronic protected health information.

Mitigation Strategies

Update the Linux kernel to the patched version that resolves this issue. Disable DRBD peer connections until patched. Monitor network traffic for suspicious DRBD protocol anomalies. Ensure data-integrity-alg is enabled if using DRBD to add protection against payload underflow.

Hi! I’m here to help you understand CVE-2026-72014. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70