CVE-2026-19617: Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser
A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the metadata to crash. This vulnerability results in a Denial of Service (DoS) for affected systems.
Other sources
The libdm configuration file parser in libdm-config.c uses recursive descent parsing with no depth limit. A crafted LVM metadata configuration with deeply nested structures causes uncontrolled recursion, exhausting the stack and crashing any LVM command that reads the metadata.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19617?
The severity of CVE-2026-19617 is medium, rated at 5.5.
What impact does CVE-2026-19617 have?
CVE-2026-19617 could lead to a denial of service through uncontrolled recursion due to malicious LVM metadata.
Which software is affected by CVE-2026-19617?
The affected software includes LVM2 and libdm (LVM2 device-mapper).
How do I fix CVE-2026-19617?
To fix CVE-2026-19617, ensure you update to the latest version of LVM2 or apply relevant patches provided by your distribution.
How can I mitigate the risks associated with CVE-2026-19617?
Mitigation for CVE-2026-19617 involves avoiding the use of untrusted LVM metadata configurations that may contain deeply nested structures.