CVE-2026-72098

A flaw was found in the dm-verity component of the Linux kernel. A buffer overflow occurs during Forward Error Correction (FEC) calculation, allowing an attacker to write past the end of an allocated buffer. This out-of-bounds write can corrupt the syndrome buffer, potentially leading to system instability or other undefined behavior.

This vulnerability is rated Important because an out-of-bounds write in kernel memory space can lead to system crashes or local privilege escalation. While typical Red Hat Enterprise Linux server installations rarely configure device-mapper verity targets with forward error correction, specialized or immutable deployments utilizing dm-verity are exposed. Triggering the defect requires processing corrupted data blocks on a mounted volume configured with error correction, confining the blast radius to environments actively running this integrity feature.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.