---
id: CVE-2026-72107
title: 'dm era: fix out-of-bounds memory access for non-zero start sector'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  dm era: fix out-of-bounds memory access for non-zero start sector

  dm-era tracks writes in target-relative blocks, but era_map() calculates
  the writeset block before ap…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= eec40579d84873dfb7021eb24c50360f073237c5 <
    fe94a0b14010a3c267ff9a2508afb4f27ff1c5bf
  - >-
    Linux >= eec40579d84873dfb7021eb24c50360f073237c5 <
    e3ffa8e492e5cdee62d916ee3e9244ccce2b73c5
  - >-
    Linux >= eec40579d84873dfb7021eb24c50360f073237c5 <
    9946a7176bd8c25ddd6e5f1799c54e572ee6bf0f
  - >-
    Linux >= eec40579d84873dfb7021eb24c50360f073237c5 <
    7e1822f83c5a1ee7b4a19e98edde8770a10b4c71
  - >-
    Linux >= eec40579d84873dfb7021eb24c50360f073237c5 <
    db5f9b4601f0012038e5a2628aedec2f47933380
  - >-
    Linux >= eec40579d84873dfb7021eb24c50360f073237c5 <
    1fcb5e29dd7a5b85adb9d8b539911741d878e829
  - >-
    Linux >= eec40579d84873dfb7021eb24c50360f073237c5 <
    bafe3e720cdac38cd7ea4eb7852a8f2dbe1bbfe6
  - >-
    Linux >= eec40579d84873dfb7021eb24c50360f073237c5 <
    a868196f03c2b19418ae3d2b69e195d668a271e5
  - Linux 3.15
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:52:12.284460Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:53:21.610Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72107'
references:
  - url: 'https://git.kernel.org/stable/c/fe94a0b14010a3c267ff9a2508afb4f27ff1c5bf'
  - url: 'https://git.kernel.org/stable/c/e3ffa8e492e5cdee62d916ee3e9244ccce2b73c5'
  - url: 'https://git.kernel.org/stable/c/9946a7176bd8c25ddd6e5f1799c54e572ee6bf0f'
  - url: 'https://git.kernel.org/stable/c/7e1822f83c5a1ee7b4a19e98edde8770a10b4c71'
  - url: 'https://git.kernel.org/stable/c/db5f9b4601f0012038e5a2628aedec2f47933380'
  - url: 'https://git.kernel.org/stable/c/1fcb5e29dd7a5b85adb9d8b539911741d878e829'
  - url: 'https://git.kernel.org/stable/c/bafe3e720cdac38cd7ea4eb7852a8f2dbe1bbfe6'
  - url: 'https://git.kernel.org/stable/c/a868196f03c2b19418ae3d2b69e195d668a271e5'
tags:
  - cve.org
epss: 0.0065
epssPercentile: 0.50154
ingestedAt: '2026-10-16T17:24:46.878Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

dm era: fix out-of-bounds memory access for non-zero start sector

dm-era tracks writes in target-relative blocks, but era_map() calculates
the writeset block before applying the target offset.  Tables with a
non-zero start sector can therefore pass an absolute mapped-device block
to metadata_current_marked().

If the absolute block is beyond the current writeset size,
writeset_marked() tests past the end of the in-core bitset.  KASAN reports
this as a vmalloc-out-of-bounds access.

Apply the target offset before calculating the era block so writeset
lookups use the target-relative block number.

## Affected

- `Linux >= eec40579d84873dfb7021eb24c50360f073237c5 < fe94a0b14010a3c267ff9a2508afb4f27ff1c5bf`
- `Linux >= eec40579d84873dfb7021eb24c50360f073237c5 < e3ffa8e492e5cdee62d916ee3e9244ccce2b73c5`
- `Linux >= eec40579d84873dfb7021eb24c50360f073237c5 < 9946a7176bd8c25ddd6e5f1799c54e572ee6bf0f`
- `Linux >= eec40579d84873dfb7021eb24c50360f073237c5 < 7e1822f83c5a1ee7b4a19e98edde8770a10b4c71`
- `Linux >= eec40579d84873dfb7021eb24c50360f073237c5 < db5f9b4601f0012038e5a2628aedec2f47933380`
- `Linux >= eec40579d84873dfb7021eb24c50360f073237c5 < 1fcb5e29dd7a5b85adb9d8b539911741d878e829`
- `Linux >= eec40579d84873dfb7021eb24c50360f073237c5 < bafe3e720cdac38cd7ea4eb7852a8f2dbe1bbfe6`
- `Linux >= eec40579d84873dfb7021eb24c50360f073237c5 < a868196f03c2b19418ae3d2b69e195d668a271e5`
- `Linux 3.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.