CVE-2026-43125
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk34th percentile — higher than 34% of all known CVEs
Summary
In the Linux kernel, the DLM (Distributed Lock Manager) module lacks validation of the 'len' parameter in the dlm_search_rsb_tree function. This parameter originates from network messages and can exceed the DLM_RESNAME_MAXLEN limit, causing an out-of-bounds write.
Risk Assessment
An attacker can remotely send a crafted network message, triggering a buffer overflow in the kernel. This could lead to system crash (DoS) or potentially arbitrary code execution in kernel context, posing a serious threat to system integrity and availability.
Recommendation
Immediately update the Linux kernel to a version containing the fix that validates the 'len' parameter in dlm_search_rsb_tree. Monitor official security advisories from your Linux distribution and apply the patch as soon as it becomes available.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: dlm: validate length in dlm_search_rsb_tree The len parameter in dlm_dump_rsb_name() is not validated and comes from network messages. When it exceeds DLM_RESNAME_MAXLEN, it can cause out-of-bounds write in dlm_search_rsb_tree(). Add length validation to prevent potential buffer overflow.