CyberSecBulletin
CVE-2026-72107NVD status: Received

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-72107 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited remotely over the network by an attacker with a low-privileged account, without any action from a user. The record lists versions fe94a0b14010a3c267ff9a2508afb4f27ff1c5bf, e3ffa8e492e5cdee62d916ee3e9244ccce2b73c5, 9946a7176bd8c25ddd6e5f1799c54e572ee6bf0f as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.65% chance of exploitation within 30 days, higher than 52% of scored CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to fe94a0b14010a3c267ff9a2508afb4f27ff1c5bf or e3ffa8e492e5cdee62d916ee3e9244ccce2b73c5 or 9946a7176bd8c25ddd6e5f1799c54e572ee6bf0f or 7e1822f83c5a1ee7b4a19e98edde8770a10b4c71, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxeec40579d84873dfb7021eb24c50360f073237c5 up to, but not including, fe94a0b14010a3c267ff9a2508afb4f27ff1c5bf; eec40579d84873dfb7021eb24c50360f073237c5 up to, but not including, e3ffa8e492e5cdee62d916ee3e9244ccce2b73c5; eec40579d84873dfb7021eb24c50360f073237c5 up to, but not including, 9946a7176bd8c25ddd6e5f1799c54e572ee6bf0f; eec40579d84873dfb7021eb24c50360f073237c5 up to, but not including, 7e1822f83c5a1ee7b4a19e98edde8770a10b4c71; eec40579d84873dfb7021eb24c50360f073237c5 up to, but not including, db5f9b4601f0012038e5a2628aedec2f47933380; eec40579d84873dfb7021eb24c50360f073237c5 up to, but not including, 1fcb5e29dd7a5b85adb9d8b539911741d878e829; eec40579d84873dfb7021eb24c50360f073237c5 up to, but not including, bafe3e720cdac38cd7ea4eb7852a8f2dbe1bbfe6; eec40579d84873dfb7021eb24c50360f073237c5 up to, but not including, a868196f03c2b19418ae3d2b69e195d668a271e5; and 1 more rangesfe94a0b14010a3c267ff9a2508afb4f27ff1c5bf, e3ffa8e492e5cdee62d916ee3e9244ccce2b73c5, 9946a7176bd8c25ddd6e5f1799c54e572ee6bf0f, 7e1822f83c5a1ee7b4a19e98edde8770a10b4c71, db5f9b4601f0012038e5a2628aedec2f47933380, 1fcb5e29dd7a5b85adb9d8b539911741d878e829

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: dm era: fix out-of-bounds memory access for non-zero start sector dm-era tracks writes in target-relative blocks, but era_map() calculates the writeset block before applying the target offset. Tables with a non-zero start sector can therefore pass an absolute mapped-device block to metadata_current_marked(). If the absolute block is beyond the current writeset size, writeset_marked() tests past the end of the in-core bitset. KASAN reports this as a vmalloc-out-of-bounds access. Apply the target offset before calculating the era block so writeset lookups use the target-relative block number.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.