CVE-2026-19617

A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the metadata to crash. This vulnerability results in a Denial of Service (DoS) for affected systems.

This Moderate impact flaw in libdm's configuration parser can lead to a denial of service. A local attacker with the ability to create or modify LVM metadata could craft a deeply nested configuration, causing LVM commands to crash due to uncontrolled recursion and stack exhaustion. This primarily affects systems where untrusted users have write access to LVM metadata.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid importing LVM physical volumes from untrusted sources without first inspecting the metadata. Systems using LVM on shared or externally-attached storage should ensure that only trusted administrators can write to the underlying block devices.