CVE-2026-72104

Received Received - Intake

dm-pcache Missing Value Parsing Flaw in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: reject option groups without values The pcache target parses optional arguments as name/value pairs. A table that advertises one optional argument and supplies only a recognized option name, for example "cache_mode", reaches parse_cache_opts() with argc == 1. The parser consumes the name, decrements argc to zero, then calls dm_shift_arg() again for the value. dm_shift_arg() returns NULL when no arguments remain, and the following strcmp() dereferences that NULL pointer. Check that each recognized option has a value before consuming it. This keeps valid "cache_mode writeback" and "data_crc true/false" tables unchanged while making malformed tables fail during target construction with a precise missing-value error.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72104

EUVD

EUVD-2026-59062

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the device-mapper (dm) pcache target. It occurs when optional arguments are provided without values, causing a NULL pointer dereference during parsing. The parser expects name/value pairs but fails when only an option name like 'cache_mode' is given without a value.

Detection Guidance

This vulnerability is specific to the Linux kernel's device-mapper cache target (dm-pcache). Detection requires checking kernel logs for errors related to dm-pcache parsing or examining device-mapper configurations for malformed table entries. No direct network detection commands are applicable.

Impact Analysis

This vulnerability could allow an attacker to crash the system by providing malformed input to the dm-pcache target. It may lead to denial-of-service conditions if exploited, potentially disrupting services relying on the device-mapper subsystem.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue related to argument parsing in the dm-pcache target, which could lead to crashes or undefined behavior if malformed input is provided. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves this issue. Avoid using malformed device-mapper cache target configurations with missing values for optional arguments. Review dm-pcache table entries to ensure all optional arguments have corresponding values.

Hi! I’m here to help you understand CVE-2026-72104. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70