External risk intelligence

Linux Kernel dm-verity Buffer Overflow in FEC Calculation.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72098

This vulnerability exists within the Linux kernel's dm-verity (device mapper) subsystem, which handles local disk integrity and error correction. It operates at the storage driver layer and is not a network-accessible service, making it highly unlikely to be exposed to the public internet.

Buffer Overflow

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability identified in the Linux kernel's dm-verity component, specifically related to error correction calculations. The issue could allow for unauthorized data manipulation within protected storage, potentially impacting data integrity on affected systems.

A Linux kernel flaw could corrupt protected data.
It matters if system data integrity is a business concern.
Verify if this kernel feature is actively used.

Attack Path

How an attacker could exploit the issue

An attacker could exploit a flaw in the Linux kernel's dm-verity component, which is responsible for data integrity checks. This vulnerability, a buffer overflow during erasure coding calculations, could allow an attacker to corrupt data structures. If triggered, this corruption could lead to the compromise of data integrity and availability.

No privileges required.
Triggered by data processed by dm-verity.
Risk to data integrity and availability.

Live Threat

Current exploitation, exposure, and threat context

A buffer overflow in the Linux kernel's dm-verity component could allow an attacker to corrupt system memory during error correction processing. This may occur when processing specific data structures related to error recovery, potentially impacting the integrity of operations relying on dm-verity.

System data integrity at risk.
Memory corruption via error handling.
Unspecified system instability.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides within the Linux kernel's dm-verity subsystem, which manages local disk integrity and error correction. Given its operational layer, immediate ownership likely falls to the infrastructure or platform teams responsible for the Linux operating system and its core components. The first practical step is to identify all Linux systems utilizing dm-verity, assess their exposure and business criticality, and then engage the respective system owners to plan remediation within scheduled maintenance windows.

Infrastructure/Platform teams own the fix.
Verify dm-verity usage and exposure.
Plan remediation during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel dm-verity component?

The dm-verity component is a feature within the Linux kernel’s device mapper framework. It provides transparent integrity checking of block devices, ensuring that data read from a disk has not been tampered with or corrupted. It is commonly used in read-only partitions, such as those found in Android devices or embedded systems, to verify the authenticity of the operating system and critical applications.

How does CVE-2026-72098 create a buffer overflow?

This vulnerability is a classic buffer overflow. It occurs during the error correction calculations performed by the dm-verity Forward Error Correction (FEC) feature. An indexing error allows the code to write data one position past the end of a memory buffer. This overflow corrupts adjacent memory, specifically a syndrome buffer used during Reed-Solomon decoding, which can lead to system instability or data integrity issues.

Does processing normal disk data trigger this flaw?

No. The flaw is specifically tied to the error correction logic within dm-verity, not the general reading of valid data. It is triggered only when the system is actively processing specific error conditions that require FEC to reconstruct corrupted data. Normal, healthy disk operations where no errors are encountered do not involve the vulnerable code path.

Why does Halo Surface Signal rate this as very unlikely?

Halo Surface Signal flags this as very unlikely because the vulnerable dm-verity code operates deep within the kernel's storage driver layer. It is not a network-facing service, meaning it does not listen for or process incoming traffic from the public internet. Because it requires interaction with local storage mechanisms to be triggered, it is generally shielded from remote exploitation attempts.

What steps should I take if I use Linux systems?

First, determine if your systems are configured to use dm-verity with Forward Error Correction, as the bug is limited to this specific combination. Once identified, coordinate with your infrastructure or platform teams to track the availability of kernel updates from your Linux distribution vendor. Plan to apply these patches during your routine maintenance windows to resolve the underlying memory safety issue.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.