CVE-2026-72097

A flaw was found in the Linux kernel's dm-verity component. A possible NULL pointer dereference can occur in the dm_verity_loadpin_is_bdev_trusted function if a device lacks a table. This vulnerability could allow a local attacker to cause a system crash, leading to a Denial of Service (DoS).

Red Hat has assessed this vulnerability as having a Low security impact because it is restricted to local Denial of Service and depends on specific LoadPin block device verification features. Red Hat Enterprise Linux does not include the affected dm-verity LoadPin integration, meaning default enterprise installations are not impacted. Additionally, any potential disruption is constrained to a system crash without compromising confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.