CVE-2026-72018

A flaw was found in the Linux kernel's dibs: loopback functionality. A missing bounds check in the move_data() function allows an attacker to provide an out-of-bounds offset or an oversized write. This can lead to an out-of-bounds write past an allocated kernel buffer, potentially causing memory corruption and a denial of service or arbitrary code execution.

This vulnerability is rated as Moderate impact because an attacker requires local access and privileges to interact with the device subsystem, limiting the blast radius to local memory corruption or denial of service. Furthermore, the affected software loopback driver is not present in supported Red Hat Enterprise Linux kernel releases. Consequently, Red Hat products are not affected by this vulnerability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.