CVE-2026-72098
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
In the Linux kernel, the dm-verity module has a buffer overflow in FEC calculation. The bug allows writing beyond the bounds of the lambda array in the RS decoder, which can corrupt the syndrome buffer. The fix addresses this overflow.
Risk Assessment
The risk includes potential memory corruption, which could lead to system crashes or remote code execution.
Recommendation
It is recommended to urgently apply the Linux kernel patch that fixes the buffer overflow in dm-verity FEC.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix buffer overflow in FEC calculation There's a buffer overflow in dm-verity-fec: if (neras && *neras <= v->fec->roots) fio->erasures[(*neras)++] = i; This allows *neras to reach roots + 1 (the post-increment pushes it past roots). This value is then passed as no_eras to decode_rs8(). Inside the RS decoder (lib/reed_solomon/decode_rs.c:113-121), the erasure locator polynomial loop writes lambda[j] where j can reach nroots + 1 — one element past the end of lambda[] (which is sized nroots + 1, valid indices 0..nroots). The out-of-bounds write lands on syn[0], corrupting the syndrome buffer.