---
id: CVE-2026-72098
title: 'dm-verity: fix buffer overflow in FEC calculation'
summary: "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-verity: fix buffer overflow in FEC calculation\n\nThere's a buffer overflow in dm-verity-fec:\n\nif (neras && *neras <= v->fec->roots)\n\tfio->erasures[(*neras)++] = i;\n\nT…"
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a739ff3f543afbb4a041c16cd0182c8e8d366e70 <
    5488d3a69d205e28f74f18857b853aa12e778e66
  - >-
    Linux >= a739ff3f543afbb4a041c16cd0182c8e8d366e70 <
    f7990c2b0f08b8841fcd2652d1d7002f5994a7a7
  - >-
    Linux >= a739ff3f543afbb4a041c16cd0182c8e8d366e70 <
    31d6e6c0ba8d5a7bd59660035a089307100c5e8e
  - Linux 4.5
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T15:51:49.534768Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:53:20.681Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72098'
references:
  - url: 'https://git.kernel.org/stable/c/5488d3a69d205e28f74f18857b853aa12e778e66'
  - url: 'https://git.kernel.org/stable/c/f7990c2b0f08b8841fcd2652d1d7002f5994a7a7'
  - url: 'https://git.kernel.org/stable/c/31d6e6c0ba8d5a7bd59660035a089307100c5e8e'
tags:
  - cve.org
epss: 0.00664
epssPercentile: 0.50725
ingestedAt: '2026-10-16T17:24:46.876Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

dm-verity: fix buffer overflow in FEC calculation

There's a buffer overflow in dm-verity-fec:

if (neras && *neras <= v->fec->roots)
	fio->erasures[(*neras)++] = i;

This allows *neras to reach roots + 1 (the post-increment pushes it past
roots). This value is then passed as no_eras to decode_rs8(). Inside the
RS decoder (lib/reed_solomon/decode_rs.c:113-121), the erasure locator
polynomial loop writes lambda[j] where j can reach nroots + 1 — one
element past the end of lambda[] (which is sized nroots + 1, valid
indices 0..nroots). The out-of-bounds write lands on syn[0], corrupting
the syndrome buffer.

## Affected

- `Linux >= a739ff3f543afbb4a041c16cd0182c8e8d366e70 < 5488d3a69d205e28f74f18857b853aa12e778e66`
- `Linux >= a739ff3f543afbb4a041c16cd0182c8e8d366e70 < f7990c2b0f08b8841fcd2652d1d7002f5994a7a7`
- `Linux >= a739ff3f543afbb4a041c16cd0182c8e8d366e70 < 31d6e6c0ba8d5a7bd59660035a089307100c5e8e`
- `Linux 4.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.