CVE-2026-110036

A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service (DoS) by inducing a user or system tool to process crafted device metadata containing an excessively large block index. An arithmetic error in the synchronous block reading logic causes the application to panic and unexpectedly terminate.

Red Hat rates this vulnerability as Low impact because exploitation requires a user to process maliciously crafted metadata with persistent data tools, resulting only in a localized process panic. The issue does not affect running kernel components, grant elevated privileges, or compromise data confidentiality or integrity. In standard Red Hat Enterprise Linux deployments, these utilities are invoked on demand for administrative storage maintenance on trusted devices, significantly limiting practical exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.