CVE-2026-72316

dm era: fix NULL pointer dereference in metadata_open()

N/A
Published: August 15, 2026 at 05:55 AM UTC
Updated: August 17, 2026 at 06:18 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: dm era: fix NULL pointer dereference in metadata_open() metadata_open() returns NULL when kzalloc_obj() fails, but the caller era_ctr() only checks IS_ERR(md). Since IS_ERR(NULL) returns false, the NULL pointer is treated as a valid result and later assigned to era->md, leading to a NULL pointer dereference when the metadata is accessed. Fix this by returning ERR_PTR(-ENOMEM) on allocation failure, consistent with dm-cache-metadata.c, dm-thin-metadata.c, and dm-clone-metadata.c which all use ERR_PTR(-ENOMEM) for the same pattern.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

3.15 ≤ v < 5.10.2613.15 ≤ v < 5.15.2123.15 ≤ v < 6.1.1783.15 ≤ v < 6.12.973.15 ≤ v < 6.18.403.15 ≤ v < 6.6.1453.15 ≤ v < 7.1.53.15 ≤ v < 7.23.15eec40579d84873dfb7021eb24c50360f073237c5
Vendor states this is fixed in 01c49eae7c6256f2d8cc08210a2bac3ee070e43a (fixed)
Vendor states this is fixed in 14e03ecd3b1b5fc03c082b27a2f8889f8290c30e (fixed)
Vendor states this is fixed in 17eb2ab13edd0b06ce6f996c5fd450d7efabb2e8 (fixed)
Vendor states this is fixed in 889374b8e4a60d13fe4a5a8ae3a311ca93d1a2c3 (fixed)
Vendor states this is fixed in 9ae672606c17891d90b282e3490b817620549599 (fixed)
Vendor states this is fixed in a705e056c2f3dd067fb2ff414f0537530baa090b (fixed)
Vendor states this is fixed in b69ea153d30ce19ca8997eeeca1e2219fae5a29b (fixed)
Vendor states this is fixed in bd5a80128bdfc93b1cae935a70da000b8c483e6e (fixed)
Vendor states this is fixed in 3.15 (unaffected)
Vendor states this is fixed in 5.10.261 (unaffected)
Vendor states this is fixed in 5.15.212 (unaffected)
Vendor states this is fixed in 6.1.178 (unaffected)
Vendor states this is fixed in 6.12.97 (unaffected)
Vendor states this is fixed in 6.18.40 (unaffected)
Vendor states this is fixed in 6.6.145 (unaffected)
Vendor states this is fixed in 7.1.5 (unaffected)
Vendor states this is fixed in 7.2 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

Quick Info

StatusRECEIVED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card