CVE-2026-72105: dm-log: fix a bitset_size overflow on 32bit machines
In the Linux kernel, the following vulnerability has been resolved:
dm-log: fix a bitsetsize overflow on 32bit machines
Commit c20e36b7631d ("dm log: fix out-of-bounds write due to regioncount overflow") made sure that regioncount could fit in an unsigned int. But the bitmap memory isn't allocated based on regioncount. It uses bitsetsize (a sizet variable). The first step of calculating bitsetsize is to set it to regioncount, rounded up to a multiple of BITSPERLONG. If regionsize is less than BITSPERLONG smaller than UINTMAX, it will get rounded up to 2^32. On a 32bit architecture, this will make bitsetsize wrap around to 0 and fail, despite regioncount being valid.
Since bitsetsize gets divided by 8, it can hold any valid regioncount. It just needs a special case to handle the rollover. If it is 0, the value rolled over, and bitset size should be set to the number of bytes needed to hold 2^32 bits.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72105?
CVE-2026-72105 has a risk rating of 23, indicating a notable vulnerability within the Linux kernel.
How do I fix CVE-2026-72105?
To fix CVE-2026-72105, ensure that you update to the latest version of the Linux kernel where this issue has been resolved.
What causes the vulnerability in CVE-2026-72105?
CVE-2026-72105 is caused by a bitset_size overflow on 32-bit machines, leading to potential out-of-bounds writes.
Which component in the Linux kernel is affected by CVE-2026-72105?
CVE-2026-72105 affects the dm-log component of the Linux kernel.
When was CVE-2026-72105 published?
CVE-2026-72105 was published on August 15, 2026.