CVE-2026-72106 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
dm-ioctl: fix a possible overflow in list_version_get_info
sizeof(tt->version) is 12 bytes, but the code writes 16 bytes into the output buffer - info->vers->version[0], info->vers->version[1],
info->vers->version[2] and info->vers->next. This can cause buffer
overflow.
Fix this buffer overflow by replacing "sizeof(tt->version)" with "sizeof(struct dm_target_versions)".
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability resides within the device mapper ioctl subsystem of the Linux kernel, specifically in the dm-ioctl module where a potential buffer overflow condition exists during version information retrieval operations. This flaw manifests when processing target version data structures, creating a scenario where memory corruption can occur due to improper buffer boundary handling. The issue stems from a mismatch between the intended data size and the actual amount of data being written to the output buffer, representing a classic buffer overflow vulnerability that could be exploited to compromise system integrity.
The technical flaw occurs at the intersection of memory management and data serialization within the device mapper framework. The code erroneously calculates buffer boundaries by using sizeof(tt->version) which equates to 12 bytes, while simultaneously writing 16 bytes of data into the target buffer structure. This discrepancy affects four specific memory locations: info->vers->version[0], info->vers->version[1], info->vers->version[2], and info->vers->next, each contributing to the overall overflow condition. The vulnerability falls under CWE-121, which describes stack-based buffer overflow conditions where insufficient space is allocated for data being written, and additionally aligns with CWE-787, describing out-of-bounds write conditions that occur when a buffer is accessed beyond its allocated bounds.
The operational impact of this vulnerability extends across multiple system components that rely on device mapper functionality, particularly affecting storage management systems, virtualization platforms, and enterprise environments utilizing Linux kernel-based storage solutions. An attacker could potentially exploit this condition to execute arbitrary code with kernel-level privileges, leading to complete system compromise. The vulnerability affects any system running the affected Linux kernel versions where device mapper ioctl operations are performed, making it a critical security concern for enterprise deployments. This flaw could be leveraged in privilege escalation attacks or denial of service scenarios that disrupt storage subsystem functionality.
Mitigation strategies should prioritize immediate kernel updates to patched versions that address the buffer overflow condition through the suggested fix of replacing sizeof(tt->version) with sizeof(struct dm_target_versions). System administrators must also implement monitoring solutions to detect anomalous device mapper activity and ensure proper access controls are maintained for ioctl operations. The fix directly addresses the root cause by ensuring proper memory allocation boundaries match the actual data being written, thereby preventing the overflow condition from occurring during target version information retrieval processes. Additionally, organizations should conduct thorough vulnerability assessments of their storage infrastructure to identify potential exposure and implement network segmentation strategies to limit potential attack vectors targeting kernel-level vulnerabilities.