CVE-2026-72108

A flaw was found in the Linux kernel's device-mapper (dm) thin metadata component. When operations involving metadata snapshots, such as reserving or releasing a snapshot, encounter a commit failure, the system can write an inconsistent 'held_root' to disk. This can lead to metadata corruption within thin-provisioned volumes, potentially resulting in data loss or integrity issues. A local attacker with privileges to manipulate device-mapper could exploit this to cause data inconsistency.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires local administrative privileges (CAP_SYS_ADMIN) to interact with device-mapper targets, limiting the attack vector. While thin-provisioned storage pools are supported across Red Hat platforms, triggering this condition requires an underlying transaction commit failure during snapshot management. Consequently, unauthorized or unprivileged users cannot directly trigger this flaw to compromise system integrity or cause a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.