CVE-2026-72018: dibs: loopback: validate offset and size in move_data()
In the Linux kernel, the following vulnerability has been resolved:
dibs: loopback: validate offset and size in movedata()
The loopback movedata() performs a memcpy into the registered DMB without checking whether offset + size exceeds the DMB length. Unlike real ISM hardware, which enforces memory region bounds natively, the software loopback has no such protection.
A peer-supplied out-of-bounds offset or oversized write would result in an OOB write past the allocated kernel buffer. Add an explicit bounds check before the memcpy to reject such requests with -EINVAL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In move_data(), add an explicit check so that offset + size does not exceed the registered DMB length; if it would, reject the request and return -EINVAL before performing memcpy.
Linux kernel loopback (move_data() in dibs: loopback) bounds checking before memcpy in move_data() = Reject requests when offset + size exceeds the DMB length; return -EINVAL
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72018?
CVE-2026-72018 has a risk score of 55, indicating a moderate level of severity.
How do I fix CVE-2026-72018?
To fix CVE-2026-72018, ensure that you update to the latest version of the Linux Kernel that addresses the vulnerability.
What are the potential impacts of CVE-2026-72018?
CVE-2026-72018 may lead to buffer overflows, potentially allowing unauthorized access or data corruption.
Which software is affected by CVE-2026-72018?
CVE-2026-72018 affects the Linux Kernel, specifically related to the dibs and loopback functionalities.
Is CVE-2026-72018 remotely exploitable?
CVE-2026-72018 is not considered remotely exploitable, but it can be triggered locally by an attacker.