CVE-2026-72107: linux Out-of-bounds Read
Vulnerability summary
CVE-2026-72107 is a high (CVSS 8.8) Out-of-bounds Read vulnerability in linux. EPSS estimates a 0.65% chance of exploitation in the next 30 days, higher than 50.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 25 · Related 25Timeline
- 15-08-2026PublishedVulnerability first disclosed.
- 19-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: dm era: fix out-of-bounds memory access for non-zero start sector dm-era tracks writes in target-relative blocks, but era_map() calculates the writeset block before applying the target offset. Tables with a non-zero start sector can therefore pass an absolute mapped-device block to metadata_current_marked(). If the absolute block is beyond the current writeset size, writeset_marked() tests past the end of the in-core bitset. KASAN reports this as a vmalloc-out-of-bounds access. Apply the target offset before calculating the era block so writeset lookups use the target-relative block number.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.65%
Chance of exploitation in the next 30 days
Percentile
50%
Versus all other CVEs
30-day change
+0.02 pp
From 0.63% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu169 products
- linuxAll versions (No fix recorded) | < 5.15.0-198.208 | < 6.8.0-147.147 | < 7.0.0-38.38
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.15.0-1117.124 | < 6.8.0-1067.70 | < 7.0.0-1014.14
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Debian1 product
- linux< 6.1.180-1 | < 6.12.100-1 | < 7.1.5-1
Linux1 product
- linux≥ eec40579d84873dfb7021eb24c50360f073237c5, < fe94a0b14010a3c267ff9a2508afb4f27ff1c5bf | ≥ eec40579d84873dfb7021eb24c50360f073237c5, < e3ffa8e492e5cdee62d916ee3e9244ccce2b73c5 | ≥ eec40579d84873dfb7021eb24c50360f073237c5, < 9946a7176bd8c25ddd6e5f1799c54e572ee6bf0f | ≥ eec40579d84873dfb7021eb24c50360f073237c5, < 7e1822f83c5a1ee7b4a19e98edde8770a10b4c71 | ≥ eec40579d84873dfb7021eb24c50360f073237c5, < db5f9b4601f0012038e5a2628aedec2f47933380 | ≥ eec40579d84873dfb7021eb24c50360f073237c5, < 1fcb5e29dd7a5b85adb9d8b539911741d878e829 | ≥ eec40579d84873dfb7021eb24c50360f073237c5, < bafe3e720cdac38cd7ea4eb7852a8f2dbe1bbfe6 | ≥ eec40579d84873dfb7021eb24c50360f073237c5, < a868196f03c2b19418ae3d2b69e195d668a271e5 | 3.15
3 vendors · 171 products
