---
id: CVE-2026-72018
title: 'dibs: loopback: validate offset and size in move_data()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  dibs: loopback: validate offset and size in move_data()

  The loopback move_data() performs a memcpy into the registered DMB
  without checking whether offset + size excee…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f7a22071dbf316c982fb44308874bd7ad9ac2091 <
    ee188a6b264b71315a67f1b9470faad308b730d2
  - >-
    Linux >= f7a22071dbf316c982fb44308874bd7ad9ac2091 <
    b2f426a9a22886071966432ede8fceafffe12b8c
  - >-
    Linux >= f7a22071dbf316c982fb44308874bd7ad9ac2091 <
    94fe0ab01b480b52bd8f977edbd845ef375d69fd
  - >-
    Linux >= f7a22071dbf316c982fb44308874bd7ad9ac2091 <
    78237e3c0720fcc6eb9b87e90fd70f63eeca886f
  - Linux 6.10
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:42:10.930913Z'
exploitAvailable: true
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:42:39.883Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72018'
references:
  - url: 'https://git.kernel.org/stable/c/ee188a6b264b71315a67f1b9470faad308b730d2'
  - url: 'https://git.kernel.org/stable/c/b2f426a9a22886071966432ede8fceafffe12b8c'
  - url: 'https://git.kernel.org/stable/c/94fe0ab01b480b52bd8f977edbd845ef375d69fd'
  - url: 'https://git.kernel.org/stable/c/78237e3c0720fcc6eb9b87e90fd70f63eeca886f'
tags:
  - cve.org
  - exploit-available
epss: 0.00175
epssPercentile: 0.06537
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/0xBlackash/CVE-2026-72018'
  checkedAt: '2026-10-16T19:46:58.904Z'
ingestedAt: '2026-10-16T19:46:24.433Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

dibs: loopback: validate offset and size in move_data()

The loopback move_data() performs a memcpy into the registered DMB
without checking whether offset + size exceeds the DMB length.  Unlike
real ISM hardware, which enforces memory region bounds natively, the
software loopback has no such protection.

A peer-supplied out-of-bounds offset or oversized write would result in
an OOB write past the allocated kernel buffer.  Add an explicit bounds
check before the memcpy to reject such requests with -EINVAL.

## Affected

- `Linux >= f7a22071dbf316c982fb44308874bd7ad9ac2091 < ee188a6b264b71315a67f1b9470faad308b730d2`
- `Linux >= f7a22071dbf316c982fb44308874bd7ad9ac2091 < b2f426a9a22886071966432ede8fceafffe12b8c`
- `Linux >= f7a22071dbf316c982fb44308874bd7ad9ac2091 < 94fe0ab01b480b52bd8f977edbd845ef375d69fd`
- `Linux >= f7a22071dbf316c982fb44308874bd7ad9ac2091 < 78237e3c0720fcc6eb9b87e90fd70f63eeca886f`
- `Linux 6.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.