{"id":"CVE-2026-72107","title":"dm era: fix out-of-bounds memory access for non-zero start sector","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm era: fix out-of-bounds memory access for non-zero start sector\n\ndm-era tracks writes in target-relative blocks, but era_map() calculates\nthe writeset block before ap…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= eec40579d84873dfb7021eb24c50360f073237c5 < fe94a0b14010a3c267ff9a2508afb4f27ff1c5bf","Linux >= eec40579d84873dfb7021eb24c50360f073237c5 < e3ffa8e492e5cdee62d916ee3e9244ccce2b73c5","Linux >= eec40579d84873dfb7021eb24c50360f073237c5 < 9946a7176bd8c25ddd6e5f1799c54e572ee6bf0f","Linux >= eec40579d84873dfb7021eb24c50360f073237c5 < 7e1822f83c5a1ee7b4a19e98edde8770a10b4c71","Linux >= eec40579d84873dfb7021eb24c50360f073237c5 < db5f9b4601f0012038e5a2628aedec2f47933380","Linux >= eec40579d84873dfb7021eb24c50360f073237c5 < 1fcb5e29dd7a5b85adb9d8b539911741d878e829","Linux >= eec40579d84873dfb7021eb24c50360f073237c5 < bafe3e720cdac38cd7ea4eb7852a8f2dbe1bbfe6","Linux >= eec40579d84873dfb7021eb24c50360f073237c5 < a868196f03c2b19418ae3d2b69e195d668a271e5","Linux 3.15"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:52:12.284460Z"},"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:53:21.610Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72107","references":[{"url":"https://git.kernel.org/stable/c/fe94a0b14010a3c267ff9a2508afb4f27ff1c5bf"},{"url":"https://git.kernel.org/stable/c/e3ffa8e492e5cdee62d916ee3e9244ccce2b73c5"},{"url":"https://git.kernel.org/stable/c/9946a7176bd8c25ddd6e5f1799c54e572ee6bf0f"},{"url":"https://git.kernel.org/stable/c/7e1822f83c5a1ee7b4a19e98edde8770a10b4c71"},{"url":"https://git.kernel.org/stable/c/db5f9b4601f0012038e5a2628aedec2f47933380"},{"url":"https://git.kernel.org/stable/c/1fcb5e29dd7a5b85adb9d8b539911741d878e829"},{"url":"https://git.kernel.org/stable/c/bafe3e720cdac38cd7ea4eb7852a8f2dbe1bbfe6"},{"url":"https://git.kernel.org/stable/c/a868196f03c2b19418ae3d2b69e195d668a271e5"}],"tags":["cve.org"],"epss":0.0065,"epssPercentile":0.50124,"ingestedAt":"2026-10-16T17:24:46.878Z","slug":"CVE-2026-72107","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndm era: fix out-of-bounds memory access for non-zero start sector\n\ndm-era tracks writes in target-relative blocks, but era_map() calculates\nthe writeset block before applying the target offset.  Tables with a\nnon-zero start sector can therefore pass an absolute mapped-device block\nto metadata_current_marked().\n\nIf the absolute block is beyond the current writeset size,\nwriteset_marked() tests past the end of the in-core bitset.  KASAN reports\nthis as a vmalloc-out-of-bounds access.\n\nApply the target offset before calculating the era block so writeset\nlookups use the target-relative block number.\n\n## Affected\n\n- `Linux >= eec40579d84873dfb7021eb24c50360f073237c5 < fe94a0b14010a3c267ff9a2508afb4f27ff1c5bf`\n- `Linux >= eec40579d84873dfb7021eb24c50360f073237c5 < e3ffa8e492e5cdee62d916ee3e9244ccce2b73c5`\n- `Linux >= eec40579d84873dfb7021eb24c50360f073237c5 < 9946a7176bd8c25ddd6e5f1799c54e572ee6bf0f`\n- `Linux >= eec40579d84873dfb7021eb24c50360f073237c5 < 7e1822f83c5a1ee7b4a19e98edde8770a10b4c71`\n- `Linux >= eec40579d84873dfb7021eb24c50360f073237c5 < db5f9b4601f0012038e5a2628aedec2f47933380`\n- `Linux >= eec40579d84873dfb7021eb24c50360f073237c5 < 1fcb5e29dd7a5b85adb9d8b539911741d878e829`\n- `Linux >= eec40579d84873dfb7021eb24c50360f073237c5 < bafe3e720cdac38cd7ea4eb7852a8f2dbe1bbfe6`\n- `Linux >= eec40579d84873dfb7021eb24c50360f073237c5 < a868196f03c2b19418ae3d2b69e195d668a271e5`\n- `Linux 3.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}