CVE-2026-72018
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In the Linux kernel, in the dibs loopback driver, the move_data() function does not validate that offset and size do not exceed the DMB length, which can lead to out-of-bounds write. The fix adds an explicit bounds check before memcpy, returning -EINVAL for invalid requests.
Risk Assessment
Risk of kernel memory corruption by a malicious user, potentially leading to system crash or privilege escalation.
Recommendation
It is recommended to update the Linux kernel to a patched version and restrict access to the DIB loopback interface.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: dibs: loopback: validate offset and size in move_data() The loopback move_data() performs a memcpy into the registered DMB without checking whether offset + size exceeds the DMB length. Unlike real ISM hardware, which enforces memory region bounds natively, the software loopback has no such protection. A peer-supplied out-of-bounds offset or oversized write would result in an OOB write past the allocated kernel buffer. Add an explicit bounds check before the memcpy to reject such requests with -EINVAL.