Bug 2516501 (CVE-2026-72098) - CVE-2026-72098 kernel: dm-verity: fix buffer overflow in FEC calculation
Summary: CVE-2026-72098 kernel: dm-verity: fix buffer overflow in FEC calculation
Keywords:
Status: NEW
Alias: CVE-2026-72098
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-15 06:15 UTC by OSIDB Bzimport
Modified: 2026-10-05 07:57 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:65334 0 None None None 2026-09-08 11:35:30 UTC
Red Hat Product Errata RHSA-2026:67150 0 None None None 2026-09-14 13:37:02 UTC
Red Hat Product Errata RHSA-2026:67468 0 None None None 2026-09-15 00:47:10 UTC
Red Hat Product Errata RHSA-2026:67469 0 None None None 2026-09-15 00:24:34 UTC
Red Hat Product Errata RHSA-2026:73645 0 None None None 2026-09-30 00:46:18 UTC
Red Hat Product Errata RHSA-2026:74174 0 None None None 2026-10-01 09:02:08 UTC
Red Hat Product Errata RHSA-2026:75560 0 None None None 2026-10-05 00:36:20 UTC

Description OSIDB Bzimport 2026-08-15 06:15:48 UTC 
In the Linux kernel, the following vulnerability has been resolved:

dm-verity: fix buffer overflow in FEC calculation

There's a buffer overflow in dm-verity-fec:

if (neras && *neras <= v->fec->roots)
	fio->erasures[(*neras)++] = i;

This allows *neras to reach roots + 1 (the post-increment pushes it past
roots). This value is then passed as no_eras to decode_rs8(). Inside the
RS decoder (lib/reed_solomon/decode_rs.c:113-121), the erasure locator
polynomial loop writes lambda[j] where j can reach nroots + 1 — one
element past the end of lambda[] (which is sized nroots + 1, valid
indices 0..nroots). The out-of-bounds write lands on syn[0], corrupting
the syndrome buffer.
Comment 1 Keith Grant 2026-08-17 21:29:49 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081524-CVE-2026-72098-cbda@gregkh/T
Comment 4 errata-xmlrpc 2026-09-08 11:35:30 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:65334 https://access.redhat.com/errata/RHSA-2026:65334
Comment 5 Jon Orris 2026-09-14 13:37:01 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:67150 https://access.redhat.com/errata/RHSA-2026:67150
Comment 6 Jon Orris 2026-09-15 00:24:33 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:67469 https://access.redhat.com/errata/RHSA-2026:67469
Comment 7 Jon Orris 2026-09-15 00:47:09 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:67468 https://access.redhat.com/errata/RHSA-2026:67468
Comment 9 Jon Orris 2026-09-30 00:46:17 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:73645 https://access.redhat.com/errata/RHSA-2026:73645
Comment 10 Jon Orris 2026-10-01 09:02:06 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:74174 https://access.redhat.com/errata/RHSA-2026:74174
Comment 11 Jon Orris 2026-10-05 00:36:19 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:75560 https://access.redhat.com/errata/RHSA-2026:75560
Note You need to log in before you can comment on or make changes to this bug.