CVE-2026-72106

Received Received - Intake

Buffer Overflow in Linux Kernel dm-ioctl

Publication date: 2026-08-15

Last updated on: 2026-08-18

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: dm-ioctl: fix a possible overflow in list_version_get_info sizeof(tt->version) is 12 bytes, but the code writes 16 bytes into the output buffer - info->vers->version[0], info->vers->version[1], info->vers->version[2] and info->vers->next. This can cause buffer overflow. Fix this buffer overflow by replacing "sizeof(tt->version)" with "sizeof(struct dm_target_versions)".

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-18

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72106

EUVD

EUVD-2026-59064

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a buffer overflow vulnerability in the Linux kernel's device mapper (dm-ioctl) component. The issue occurs when the code writes 16 bytes into a buffer that should only hold 12 bytes, causing a potential overflow. Specifically, it writes to info->vers->version[0], info->vers->version[1], info->vers->version[2], and info->vers->next, exceeding the allocated space for tt->version.

Detection Guidance

This vulnerability is specific to the Linux kernel's device-mapper (dm-ioctl) component. Detection requires checking the kernel version and whether the vulnerable code path is present. Use uname -a to check kernel version and grep for dm-ioctl in kernel logs or code. No direct network detection commands are applicable.

Impact Analysis

This vulnerability could allow an attacker to corrupt kernel memory, potentially leading to system crashes, privilege escalation, or arbitrary code execution. If exploited, it may compromise the integrity and security of the affected system.

Compliance Impact

This vulnerability is a buffer overflow in the Linux kernel's dm-ioctl component. It does not directly affect compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy controls rather than kernel-level memory issues.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this buffer overflow. If immediate patching is not possible, restrict access to device-mapper ioctl operations or disable affected dm-target modules until the kernel is updated.

Hi! I’m here to help you understand CVE-2026-72106. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70