{"id":"CVE-2026-72107","revision":"84dab40b2c6549a2ba889d6d56c88811","records":[{"revision":"84dab40b2c6549a2ba889d6d56c88811","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-72107","aliases":[],"title":"dm era: fix out-of-bounds memory access for non-zero start sector","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm era: fix out-of-bounds memory access for non-zero start sector\n\ndm-era tracks writes in target-relative blocks, but era_map() calculates\nthe writeset block before applying the target offset.  Tables with a\nnon-zero start sector can therefore pass an absolute mapped-device block\nto metadata_current_marked().\n\nIf the absolute block is beyond the current writeset size,\nwriteset_marked() tests past the end of the in-core bitset.  KASAN reports\nthis as a vmalloc-out-of-bounds access.\n\nApply the target offset before calculating the era block so writeset\nlookups use the target-relative block number.","state":0,"publishedAt":"2026-08-15T05:52:49.581+00:00","modifiedAt":"2026-10-19T21:19:28.417+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/md/dm-era-target.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"eec40579d84873dfb7021eb24c50360f073237c5\",\n                            \"lessThan\": \"fe94a0b14010a3c267ff9a2508afb4f27ff1c5bf\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"eec40579d84873dfb7021eb24c50360f073237c5\",\n                            \"lessThan\": \"e3ffa8e492e5cdee62d916ee3e9244ccce2b73c5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"eec40579d84873dfb7021eb24c50360f073237c5\",\n                            \"lessThan\": \"9946a7176bd8c25ddd6e5f1799c54e572ee6bf0f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"eec40579d84873dfb7021eb24c50360f073237c5\",\n                            \"lessThan\": \"7e1822f83c5a1ee7b4a19e98edde8770a10b4c71\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"eec40579d84873dfb7021eb24c50360f073237c5\",\n                            \"lessThan\": \"db5f9b4601f0012038e5a2628aedec2f47933380\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"eec40579d84873dfb7021eb24c50360f073237c5\",\n                            \"lessThan\": \"1fcb5e29dd7a5b85adb9d8b539911741d878e829\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"eec40579d84873dfb7021eb24c50360f073237c5\",\n                            \"lessThan\": \"bafe3e720cdac38cd7ea4eb7852a8f2dbe1bbfe6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"eec40579d84873dfb7021eb24c50360f073237c5\",\n                            \"lessThan\": \"a868196f03c2b19418ae3d2b69e195d668a271e5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/md/dm-era-target.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.15\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.15\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.261\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.212\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.178\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.145\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.97\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.40\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.5\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/fe94a0b14010a3c267ff9a2508afb4f27ff1c5bf","https://git.kernel.org/stable/c/e3ffa8e492e5cdee62d916ee3e9244ccce2b73c5","https://git.kernel.org/stable/c/9946a7176bd8c25ddd6e5f1799c54e572ee6bf0f","https://git.kernel.org/stable/c/7e1822f83c5a1ee7b4a19e98edde8770a10b4c71","https://git.kernel.org/stable/c/db5f9b4601f0012038e5a2628aedec2f47933380","https://git.kernel.org/stable/c/1fcb5e29dd7a5b85adb9d8b539911741d878e829","https://git.kernel.org/stable/c/bafe3e720cdac38cd7ea4eb7852a8f2dbe1bbfe6","https://git.kernel.org/stable/c/a868196f03c2b19418ae3d2b69e195d668a271e5"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72107","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-72107","identifiers":["CVE-2026-72107"]},"retained":false,"historicalAffected":[]}],"coverage":[]}