CVE-2026-72098 (GCVE-0-2026-72098)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:52 – Updated: 2026-08-17 05:40
VLAI
Title
dm-verity: fix buffer overflow in FEC calculation
Summary
In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix buffer overflow in FEC calculation There's a buffer overflow in dm-verity-fec: if (neras && *neras <= v->fec->roots) fio->erasures[(*neras)++] = i; This allows *neras to reach roots + 1 (the post-increment pushes it past roots). This value is then passed as no_eras to decode_rs8(). Inside the RS decoder (lib/reed_solomon/decode_rs.c:113-121), the erasure locator polynomial loop writes lambda[j] where j can reach nroots + 1 — one element past the end of lambda[] (which is sized nroots + 1, valid indices 0..nroots). The out-of-bounds write lands on syn[0], corrupting the syndrome buffer.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a739ff3f543afbb4a041c16cd0182c8e8d366e70 , < 5488d3a69d205e28f74f18857b853aa12e778e66 (git)
Affected: a739ff3f543afbb4a041c16cd0182c8e8d366e70 , < f7990c2b0f08b8841fcd2652d1d7002f5994a7a7 (git)
Affected: a739ff3f543afbb4a041c16cd0182c8e8d366e70 , < 31d6e6c0ba8d5a7bd59660035a089307100c5e8e (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.5
Unaffected: 0 , < 4.5 (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-verity-fec.c",
            "drivers/md/dm-verity-fec.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5488d3a69d205e28f74f18857b853aa12e778e66",
              "status": "affected",
              "version": "a739ff3f543afbb4a041c16cd0182c8e8d366e70",
              "versionType": "git"
            },
            {
              "lessThan": "f7990c2b0f08b8841fcd2652d1d7002f5994a7a7",
              "status": "affected",
              "version": "a739ff3f543afbb4a041c16cd0182c8e8d366e70",
              "versionType": "git"
            },
            {
              "lessThan": "31d6e6c0ba8d5a7bd59660035a089307100c5e8e",
              "status": "affected",
              "version": "a739ff3f543afbb4a041c16cd0182c8e8d366e70",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-verity-fec.c",
            "drivers/md/dm-verity-fec.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.5"
            },
            {
              "lessThan": "4.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-verity: fix buffer overflow in FEC calculation\n\nThere\u0027s a buffer overflow in dm-verity-fec:\n\nif (neras \u0026\u0026 *neras \u003c= v-\u003efec-\u003eroots)\n\tfio-\u003eerasures[(*neras)++] = i;\n\nThis allows *neras to reach roots + 1 (the post-increment pushes it past\nroots). This value is then passed as no_eras to decode_rs8(). Inside the\nRS decoder (lib/reed_solomon/decode_rs.c:113-121), the erasure locator\npolynomial loop writes lambda[j] where j can reach nroots + 1 \u2014 one\nelement past the end of lambda[] (which is sized nroots + 1, valid\nindices 0..nroots). The out-of-bounds write lands on syn[0], corrupting\nthe syndrome buffer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - In cloud/network-boot deployments where dm-verity data, hash, or FEC backing devices are served over NBD/iSCSI/TCP, a remote block provider can supply crafted blocks that drive the FEC erasure-correction path during ordinary read I/O through verity_map without local code execution.\nAC:L - A crafted backing image or malicious network-block responses can deterministically produce at least fec_roots+1 hash-mismatched or failed message blocks in one RS group, reliably reaching the off-by-one no_eras path on the second FEC decode attempt after verification failure.\nPR:N - Triggering requires only read I/O against an active dm-verity+FEC mapping; a remote NBD/iSCSI peer needs no account or privileges on the victim host, and unprivileged local processes with read access to the mapped device or filesystem can also reach the vulnerable FEC path.\nUI:N - Exploitation is driven by automatic boot-time reads, udev probing, or ordinary filesystem I/O on the dm-verity device; no specific victim action beyond normal system operation is required once corruption is present.\nS:U - The overflow corrupts kernel heap Reed-Solomon scratch buffers during dm-verity verification within the same kernel security authority; it does not by itself cross VM, IOMMU, or sandbox boundaries.\nC:H - The inflated no_eras value causes decode_rs8 to XOR-write one uint16 past lambda[] into syn[0], corrupting adjacent kernel decoder state; such heap out-of-bounds writes can be leveraged for arbitrary memory disclosure.\nI:H - The same out-of-bounds write in the erasure-locator loop corrupts syndrome buffers later used to modify decoded message bytes, providing a heap memory-corruption primitive that can enable arbitrary kernel writes or control-flow hijacking.\nA:H - Corrupting Reed-Solomon decoder state during dm-verity verification can cause kernel oops, panics, or hung I/O on critical read-only partitions (notably Android/embedded systems with FEC enabled), denying availability of the device or entire system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:40:13.507Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5488d3a69d205e28f74f18857b853aa12e778e66"
        },
        {
          "url": "https://git.kernel.org/stable/c/f7990c2b0f08b8841fcd2652d1d7002f5994a7a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/31d6e6c0ba8d5a7bd59660035a089307100c5e8e"
        }
      ],
      "title": "dm-verity: fix buffer overflow in FEC calculation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72098",
    "datePublished": "2026-08-15T05:52:43.666Z",
    "dateReserved": "2026-08-09T03:40:39.905Z",
    "dateUpdated": "2026-08-17T05:40:13.507Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72098",
      "date": "2026-08-23",
      "epss": "0.00646",
      "percentile": "0.48033"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-72098\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:21:23.897\",\"lastModified\":\"2026-08-17T06:18:08.687\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndm-verity: fix buffer overflow in FEC calculation\\n\\nThere\u0027s a buffer overflow in dm-verity-fec:\\n\\nif (neras \u0026\u0026 *neras \u003c= v-\u003efec-\u003eroots)\\n\\tfio-\u003eerasures[(*neras)++] = i;\\n\\nThis allows *neras to reach roots + 1 (the post-increment pushes it past\\nroots). This value is then passed as no_eras to decode_rs8(). Inside the\\nRS decoder (lib/reed_solomon/decode_rs.c:113-121), the erasure locator\\npolynomial loop writes lambda[j] where j can reach nroots + 1 \u2014 one\\nelement past the end of lambda[] (which is sized nroots + 1, valid\\nindices 0..nroots). The out-of-bounds write lands on syn[0], corrupting\\nthe syndrome buffer.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/md/dm-verity-fec.c\",\"drivers/md/dm-verity-fec.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a739ff3f543afbb4a041c16cd0182c8e8d366e70\",\"lessThan\":\"5488d3a69d205e28f74f18857b853aa12e778e66\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a739ff3f543afbb4a041c16cd0182c8e8d366e70\",\"lessThan\":\"f7990c2b0f08b8841fcd2652d1d7002f5994a7a7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a739ff3f543afbb4a041c16cd0182c8e8d366e70\",\"lessThan\":\"31d6e6c0ba8d5a7bd59660035a089307100c5e8e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/md/dm-verity-fec.c\",\"drivers/md/dm-verity-fec.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/31d6e6c0ba8d5a7bd59660035a089307100c5e8e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5488d3a69d205e28f74f18857b853aa12e778e66\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f7990c2b0f08b8841fcd2652d1d7002f5994a7a7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-20T10:31:13+00:00",
      "cve": "CVE-2026-72098",
      "id": "CVE-2026-72098",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: dm-verity: fix buffer overflow in FEC calculation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72098.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-18T16:54:55Z",
      "cve": "CVE-2026-72098",
      "id": "CVE-2026-72098",
      "initial_release_date": "2026-08-18T16:54:55Z",
      "product_status:known_affected": "280",
      "product_status:known_not_affected": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72098",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72098.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.