CVE-2026-72098dm-verity: fix buffer overflow in FEC calculation
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix buffer overflow in FEC calculation There's a buffer overflow in dm-verity-fec: if (neras && *neras <= v->fec->roots) fio->erasures[(*neras)++] = i; This allows *neras to reach roots + 1 (the post-increment pushes it past roots). This value is then passed as no_eras to decode_rs8(). Inside the RS decoder (lib/reed_solomon/decode_rs.c:113-121), the erasure locator polynomial loop writes lambda[j] where j can reach nroots + 1 — one element past the end of lambda[] (which is sized nroots + 1, valid indices 0..nroots). The out-of-bounds write lands on syn[0], corrupting the syndrome buffer.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from a739ff3f543afbb4a041c16cd0182c8e8d366e70 before 5488d3a69d205e28f74f18857b853aa12e778e66; from a739ff3f543afbb4a041c16cd0182c8e8d366e70 before f7990c2b0f08b8841fcd2652d1d7002f5994a7a7; from a739ff3f543afbb4a041c16cd0182c8e8d366e70 before 31d6e6c0ba8d5a7bd59660035a089307100c5e8e | CNA record |
References
- https://git.kernel.org/stable/c/5488d3a69d205e28f74f18857b853aa12e778e66
- https://git.kernel.org/stable/c/f7990c2b0f08b8841fcd2652d1d7002f5994a7a7
- https://git.kernel.org/stable/c/31d6e6c0ba8d5a7bd59660035a089307100c5e8e
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.