CVE-2026-72018 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
dibs: loopback: validate offset and size in move_data()
The loopback move_data() performs a memcpy into the registered DMB without checking whether offset + size exceeds the DMB length. Unlike real ISM hardware, which enforces memory region bounds natively, the software loopback has no such protection.
A peer-supplied out-of-bounds offset or oversized write would result in an OOB write past the allocated kernel buffer. Add an explicit bounds check before the memcpy to reject such requests with -EINVAL.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability resides within the Linux kernel's loopback implementation for DMB (Data Memory Buffer) operations, specifically in the move_data() function that handles data movement between memory regions. This flaw represents a classic out-of-bounds write condition that could potentially be exploited to corrupt kernel memory and compromise system integrity. The issue manifests when the loopback subsystem processes data transfers without proper validation of memory access parameters, creating a scenario where malicious or malformed input could trigger unauthorized memory modifications.
The technical implementation flaw occurs because the move_data() function directly executes a memcpy operation into the registered DMB buffer without first verifying that the specified offset plus size parameters remain within the allocated buffer boundaries. This validation gap is particularly concerning because unlike physical ISM (InfiniBand Shared Memory) hardware that naturally enforces memory region limits through hardware mechanisms, the software loopback implementation lacks this native protection layer. The absence of bounds checking creates an exploitable condition where an attacker could supply crafted offset and size values that exceed the DMB's actual length.
The operational impact of this vulnerability extends beyond simple memory corruption, as it could enable privilege escalation or system instability through controlled buffer overflows. When a peer supplies out-of-bounds parameters, the kernel's memory management structure becomes vulnerable to unauthorized modifications, potentially allowing attackers to overwrite adjacent memory regions with malicious data. This type of vulnerability aligns with CWE-129, which specifically addresses insufficient validation of length of inputs, and represents a clear violation of the principle of least privilege in kernel space operations.
The security implications become more severe when considering that such vulnerabilities can be leveraged through the ATT&CK framework's privilege escalation techniques, particularly those involving kernel exploits. The vulnerability creates an entry point for malicious actors to manipulate kernel memory structures, potentially leading to complete system compromise. The fix implemented involves adding explicit bounds checking before any memcpy operation, returning -EINVAL to reject invalid requests that would otherwise cause out-of-bounds writes.
Mitigation strategies should focus on implementing comprehensive input validation at all levels of the kernel's memory management subsystem, with particular attention to buffer boundary checks in software implementations that lack hardware-enforced protections. The solution addresses the fundamental issue by ensuring that all data movement operations validate their parameters against allocated buffer boundaries before proceeding with memory operations. This approach aligns with industry best practices for secure coding and represents a necessary defensive measure against exploitation attempts targeting kernel memory corruption vulnerabilities.