CVE-2026-72107

A flaw was found in the Linux kernel's device-mapper (dm-era) component. This vulnerability arises from an incorrect calculation of writeset blocks, which can lead to an out-of-bounds memory access. An attacker could potentially exploit this to cause a denial of service or other undefined behavior due to memory corruption.

dm-era can perform an out-of-bounds bitset access when a target is configured with a non-zero start sector because the era block is calculated before applying the target-relative offset. Local I/O to such a mapped device can pass an absolute mapped-device block into the writeset lookup, causing writeset_marked to test memory past the end of the in-core bitset. For the CVSS the PR:L is used for the paranoid score because an unprivileged local user or service may be able to trigger I/O after an administrator has already created the affected dm-era mapping. The issue is not directly network reachable. Impact is at least local denial of service via kernel crash, with limited confidentiality or integrity impact possible from an out-of-bounds read affecting metadata decisions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.