CVE-2026-72014 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
drbd: reject data replies with an out-of-range payload size
recv_dless_read() receives a P_DATA_REPLY from a peer into the bio of an outstanding read request. The peer-supplied payload length reaches it as the signed int data_size, and two peer-controlled inputs can make it negative. With a negotiated data-integrity-alg the digest length is subtracted first, so a reply whose payload is smaller than the digest underflows data_size. With no integrity algorithm (the default) data_size is assigned from the unsigned h95/h100 wire length and drbdd() never bounds it for a payload-carrying command, so a length above INT_MAX casts it negative; this path needs no non-default feature. The bio receive loop then computes expect = min_t(int, data_size, bv_len), which is negative, and drbd_recv_all_warn(mapped, expect) receives with a size_t of SIZE_MAX into the first mapped page.
The sibling receive path read_in_block() is not affected: it uses an unsigned size and rejects it against DRBD_MAX_BIO_SIZE before receiving. Reject a data reply whose size is negative after the optional digest subtraction, covering both triggers.
Impact: a malicious or man-in-the-middle DRBD peer copies attacker-chosen bytes past a bio page in the receiver, corrupting kernel memory. A node that reads from its peer (a diskless node, or read-balancing to the peer) is exposed in the default configuration; data-integrity-alg is not required.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability in question affects the Distributed Replicated Block Device implementation within the Linux kernel, specifically targeting the data reply processing mechanism in the drbd subsystem. This issue manifests when the recv_dless_read() function handles P_DATA_REPLY messages from peer nodes, creating a critical memory corruption scenario through improper handling of payload size parameters. The flaw resides in how the system processes signed integer values representing data_size, which can become negative due to two distinct peer-controlled inputs that manipulate the payload length calculations.
The technical execution pathway begins with the processing of peer-supplied data where data_size is initially computed as a signed integer from the wire protocol header. When data-integrity-alg is negotiated, the digest length subtraction can cause underflow conditions that result in negative data_size values, while in default configurations without integrity algorithms, unsigned wire length values exceeding INT_MAX undergo casting to negative numbers during the conversion process. This vulnerability operates through a specific code path where the bio receive loop computes expect = min_t(int, data_size, bv_len) using the potentially negative data_size value, ultimately leading to drbd_recv_all_warn() being called with size_t parameters of SIZE_MAX that exceed the bounds of the first mapped page.
The operational impact represents a severe kernel memory corruption vulnerability classified under CWE-129 as an "Improper Validation of Array Index" and CWE-787 as an "Out-of-bounds Write." The attack vector requires only a malicious or man-in-the-middle DRBD peer to exploit, making it particularly dangerous in networked environments where such adversarial conditions can occur. The vulnerability affects nodes that read from their peers, which includes diskless nodes or those implementing read-balancing strategies, and operates without requiring any special configuration beyond the default setup. This exposure creates a persistent risk for all DRBD implementations where peer communication occurs, regardless of whether data integrity algorithms are enabled.
Mitigation strategies should focus on immediate implementation of input validation checks that reject data replies with negative size values after digest processing, as suggested in the resolution approach. System administrators must ensure that DRBD configurations properly validate incoming payload sizes before processing, implementing bounds checking that prevents negative values from propagating through the system. The fix should incorporate explicit range validation in the recv_dless_read() function to reject malformed data replies before they can trigger memory corruption. Additionally, network segmentation and authentication controls should be strengthened around DRBD peer communications to reduce the attack surface for man-in-the-middle scenarios, while monitoring systems should be enhanced to detect anomalous payload size patterns that might indicate exploitation attempts.
This vulnerability demonstrates a classic example of how integer overflow conditions in kernel space can lead to memory corruption through improper bounds checking, aligning with ATT&CK technique T1068 which covers "Exploitation for Privilege Escalation" and T1566 which addresses "Phishing with Social Engineering". The attack requires minimal privileges from the adversarial peer but can result in complete system compromise through kernel memory corruption, making it particularly dangerous in enterprise environments where DRBD is commonly deployed for storage replication and high availability solutions.