CVE-2026-72101 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
dm-integrity: fix leaking uninitialized kernel memory
If hash size is less than device's tuple size, dm-integrity is supposed to zero the remaining space. There was a bug in the code that zeroing didn't work. This commit fixes it.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability resides within the dm-integrity subsystem of the Linux kernel, specifically addressing a memory disclosure issue that could potentially expose uninitialized kernel memory to userspace applications. This flaw manifests when the hash size configured for the device integrity mapping is smaller than the device's tuple size, creating a scenario where residual uninitialized memory contents could be leaked through the data processing pipeline. The technical implementation error occurs during the zeroing operation that should occur in such mismatched conditions, where the kernel fails to properly sanitize the remaining buffer space.
This vulnerability represents a classic information disclosure weakness that can be categorized under CWE-200, Information Exposure, and more specifically aligns with CWE-1308, which deals with improper initialization of data structures. The flaw exists in the device mapper integrity module's handling of cryptographic hash verification data structures where insufficient memory sanitization occurs when hash parameters don't align with device tuple requirements. The operational impact is significant as this allows for potential leakage of kernel memory contents that may include sensitive information such as cryptographic keys, session tokens, or other confidential data structures that could be accessed by malicious processes with appropriate privileges or through exploitation of related vulnerabilities.
The security implications extend beyond simple memory disclosure to potentially enable attackers to gather intelligence about the kernel's internal state and memory layout. According to ATT&CK framework category T1005, this vulnerability could facilitate data hijacking techniques where adversaries might extract sensitive information from the kernel memory space. The issue particularly affects systems utilizing device mapper integrity for storage encryption or verification purposes, where the integrity checking mechanism is designed to ensure data consistency but inadvertently exposes uninitialized memory regions through improper zeroing operations.
Mitigation strategies should focus on applying the upstream kernel patch that corrects the zeroing logic in dm-integrity module to ensure proper memory sanitization when hash sizes don't match device tuple requirements. System administrators should prioritize kernel updates across all affected systems, particularly those running device mapper integrity configurations, and monitor for any potential exploitation attempts targeting this specific memory disclosure vulnerability. The fix ensures that when hash size is less than the device's tuple size, the remaining buffer space is properly zeroed before being processed or returned to userspace applications, thereby preventing leakage of uninitialized kernel memory contents.