CVE-2026-72014

A flaw was found in DRBD, a component of the Linux kernel. A malicious or man-in-the-middle DRBD peer can send a specially crafted data reply with an out-of-range payload size. This incorrect size calculation can lead to an out-of-bounds write, allowing the attacker to copy arbitrary data past a buffer in kernel memory. This kernel memory corruption could result in system instability or potentially enable an attacker to execute arbitrary code.

Moderate impact has been assigned to this vulnerability because exploitation requires an established network session with a compromised DRBD peer to trigger the memory corruption, limiting the attack surface to specialized cluster environments. The DRBD subsystem is not built or supported in standard Red Hat Enterprise Linux kernels, so the vulnerable code is not present in default installations. Therefore, typical Red Hat deployments are not exposed to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.