CVE-2026-19617

Vendor solution

Avoid importing LVM physical volumes from untrusted sources without first inspecting the metadata. Systems using LVM on shared or externally-attached storage should ensure that only trusted administrators can write to the underlying block devices.

Red Hat statement

This Moderate impact flaw in libdm's configuration parser can lead to a denial of service. A local attacker with the ability to create or modify LVM metadata could craft a deeply nested configuration, causing LVM commands to crash due to uncontrolled recursion and stack exhaustion. This primarily affects systems where untrusted users have write access to LVM metadata.

Red Hat mitigation

Avoid importing LVM physical volumes from untrusted sources without first inspecting the metadata. Systems using LVM on shared or externally-attached storage should ensure that only trusted administrators can write to the underlying block devices.