CoreCVE
Back

CRITICAL

dm-verity: fix buffer overflow in FEC calculation

Published Aug 15, 2026

Description

There's a buffer overflow in dm-verity-fec:

if (neras && *neras <= v->fec->roots) fio->erasures[(*neras)++] = i;

This allows *neras to reach roots + 1 (the post-increment pushes it past roots). This value is then passed as no_eras to decode_rs8(). Inside the RS decoder (lib/reed_solomon/decode_rs.c:113-121), the erasure locator polynomial loop writes lambda[j] where j can reach nroots + 1 — one element past the end of lambda[] (which is sized nroots + 1, valid indices 0..nroots). The out-of-bounds write lands on syn[0], corrupting the syndrome buffer.

Affected products

Remediation

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Weaknesses (1)

CWE-787

Out-of-bounds Write

References (9)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Linux
Published Aug 15, 2026
Updated Aug 17, 2026
Reserved Aug 9, 2026
Link CVE-2026-72098
CISA Vulnrichment
Updated n/a
NVD
Status Received
Modified Aug 17, 2026
Link CVE-2026-72098
Red Hat
Severity Important
Public date Aug 15, 2026
Links CVE-2026-72098 - Bugzilla
ENISA EUVD
Assigner Linux
Published Aug 15, 2026
Updated Aug 17, 2026
Exploited since n/a
Link EUVD-2026-59056
EUVD-2026-59056