{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-verity-fec.c",
            "drivers/md/dm-verity-fec.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5488d3a69d205e28f74f18857b853aa12e778e66",
              "status": "affected",
              "version": "a739ff3f543afbb4a041c16cd0182c8e8d366e70",
              "versionType": "git"
            },
            {
              "lessThan": "f7990c2b0f08b8841fcd2652d1d7002f5994a7a7",
              "status": "affected",
              "version": "a739ff3f543afbb4a041c16cd0182c8e8d366e70",
              "versionType": "git"
            },
            {
              "lessThan": "31d6e6c0ba8d5a7bd59660035a089307100c5e8e",
              "status": "affected",
              "version": "a739ff3f543afbb4a041c16cd0182c8e8d366e70",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-verity-fec.c",
            "drivers/md/dm-verity-fec.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.5"
            },
            {
              "lessThan": "4.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-verity: fix buffer overflow in FEC calculation\n\nThere\u0027s a buffer overflow in dm-verity-fec:\n\nif (neras \u0026\u0026 *neras \u003c= v-\u003efec-\u003eroots)\n\tfio-\u003eerasures[(*neras)++] = i;\n\nThis allows *neras to reach roots + 1 (the post-increment pushes it past\nroots). This value is then passed as no_eras to decode_rs8(). Inside the\nRS decoder (lib/reed_solomon/decode_rs.c:113-121), the erasure locator\npolynomial loop writes lambda[j] where j can reach nroots + 1 \u2014 one\nelement past the end of lambda[] (which is sized nroots + 1, valid\nindices 0..nroots). The out-of-bounds write lands on syn[0], corrupting\nthe syndrome buffer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - In cloud/network-boot deployments where dm-verity data, hash, or FEC backing devices are served over NBD/iSCSI/TCP, a remote block provider can supply crafted blocks that drive the FEC erasure-correction path during ordinary read I/O through verity_map without local code execution.\nAC:L - A crafted backing image or malicious network-block responses can deterministically produce at least fec_roots+1 hash-mismatched or failed message blocks in one RS group, reliably reaching the off-by-one no_eras path on the second FEC decode attempt after verification failure.\nPR:N - Triggering requires only read I/O against an active dm-verity+FEC mapping; a remote NBD/iSCSI peer needs no account or privileges on the victim host, and unprivileged local processes with read access to the mapped device or filesystem can also reach the vulnerable FEC path.\nUI:N - Exploitation is driven by automatic boot-time reads, udev probing, or ordinary filesystem I/O on the dm-verity device; no specific victim action beyond normal system operation is required once corruption is present.\nS:U - The overflow corrupts kernel heap Reed-Solomon scratch buffers during dm-verity verification within the same kernel security authority; it does not by itself cross VM, IOMMU, or sandbox boundaries.\nC:H - The inflated no_eras value causes decode_rs8 to XOR-write one uint16 past lambda[] into syn[0], corrupting adjacent kernel decoder state; such heap out-of-bounds writes can be leveraged for arbitrary memory disclosure.\nI:H - The same out-of-bounds write in the erasure-locator loop corrupts syndrome buffers later used to modify decoded message bytes, providing a heap memory-corruption primitive that can enable arbitrary kernel writes or control-flow hijacking.\nA:H - Corrupting Reed-Solomon decoder state during dm-verity verification can cause kernel oops, panics, or hung I/O on critical read-only partitions (notably Android/embedded systems with FEC enabled), denying availability of the device or entire system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:40:13.507Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5488d3a69d205e28f74f18857b853aa12e778e66"
        },
        {
          "url": "https://git.kernel.org/stable/c/f7990c2b0f08b8841fcd2652d1d7002f5994a7a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/31d6e6c0ba8d5a7bd59660035a089307100c5e8e"
        }
      ],
      "title": "dm-verity: fix buffer overflow in FEC calculation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72098",
    "datePublished": "2026-08-15T05:52:43.666Z",
    "dateReserved": "2026-08-09T03:40:39.905Z",
    "dateUpdated": "2026-08-17T05:40:13.507Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}