device-mapper-persistent-data Denial of Service via u64::MAX Overflow CVE-2026-110036

Vulnerability Overview Vulnerability ID: Bug 2474403 (CVE-2026-110036) Vulnerability Type: Denial of Service (DoS) Affected Component: Description: In the synchronous read path, constructing a block index leads to a overflow, triggering a panic. Attackers can trigger this vulnerability by providing malicious metadata or images. Impact Scope Hardware: All hardware Operating System: Linux Priority: Low Severity: Low Target Milestone: Product Security QA Contact: Not specified Documentation Contact: Not specified URL: Not specified Whiteboard: Not specified Dependencies: 2550678 Blocks: Not specified Tree/View: Depends on blocking items Remediation Patch Availability: No patch package has been released, but the following patches are provided: - Upstream Coordination: Not notified - CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - 5.5 (MEDIUM) - AV (Attack Vector): The attacker requires local access to provide malicious metadata or images. - AC (Attack Complexity): The trigger condition is a simple block index that leads to a normal batch processing path. - PR (Privileges Required): Privileges are not required in the vulnerable component. - UI (User Interaction): A user or automation must invoke the affected tool. - S (Scope): The impact is limited to the affected process. - C/I (Confidentiality/Integrity): No confidentiality or integrity impact has been demonstrated. - A (Availability): The process may crash and terminate, preventing the requested operation from completing. - Impact: Medium. According to Red Hat's severity guidelines, this represents a genuine availability impact in an accessible code path, but it does not rise to Important or Critical because the demonstrated attack is locally initiated and input-driven, rather than involving remote service compromise or system compromise. If successful exploitation directly terminates the affected process, the availability impact could be considered higher. - Mitigation: Before applying the fix, avoid processing unverified metadata from the affected build, and reject block indices that equal or exceed the valid device block range. Caller-side validation is a useful short-term defense, but it should not replace fixing the underlying arithmetic and empty buffer handling. - Recommended Fix: Use checked arithmetic to construct end-exclusive ranges and return early from reads on empty vectors. POC Code Additional Information Reported Time: 2026-05-11 21:52:52 UTC by OSDB Bzimport Modified Time: 2026-10-13 16:41 UTC (history) CC List: 18 users (priv) Fixed Version: Not specified Resolution: Not specified Environment: Not specified Last Closed: Not specified Embargoed: Not specified Attachments Attachments: Not specified Terms: Not specified Notes Login is required to comment on or make changes to this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

device-mapper-persistent-data Denial of Service via u64::MAX Overflow CVE-2026-110036