CVE-2026-72098

CVE CVE-2026-72098EUVD EUVD-2026-59056Published 2026-08-15T05:52:43.000ZLast changed 2026-08-17T05:40:13.000ZCVSS 9.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix buffer overflow in FEC calculation There's a buffer overflow in dm-verity-fec: if (neras && *neras <= v->fec->roots) fio->erasures[(*neras)++] = i; This allows *neras to reach roots + 1 (the post-increment pushes it past roots). This value is then passed as no_eras to decode_rs8(). Inside the RS decoder (lib/reed_solomon/decode_rs.c:113-121), the erasure locator polynomial loop writes lambda[j] where j can reach nroots + 1 — one element past the end of lambda[] (which is sized nroots + 1, valid indices 0..nroots). The out-of-bounds write lands on syn[0], corrupting the syndrome buffer.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux a739ff3f543afbb4a041c16cd0182c8e8d366e70 <31d6e6c0ba8d5a7bd59660035a089307100c5e8e; patch: 7.1.5; a739ff3f543afbb4a041c16cd0182c8e8d366e70 <f7990c2b0f08b8841fcd2652d1d7002f5994a7a7; 4.5; patch: 6.18.42; patch: 0; a739ff3f543afbb4a041c16cd0182c8e8d366e70 <5488d3a69d205e28f74f18857b853aa12e778e66; patch: 7.2

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.