In the Linux kernel, the following vulnerability has been resolved:
dm-verity: fix buffer overflow in FEC calculation
There's a buffer overflow in dm-verity-fec:
if (neras && *neras <= v->fec->roots) fio->erasures[(*neras)++] = i;
This allows *neras to reach roots + 1 (the post-increment pushes it past roots). This value is then passed as no_eras to decode_rs8(). Inside the RS decoder (lib/reed_solomon/decode_rs.c:113-121), the erasure locator polynomial loop writes lambda[j] where j can reach nroots + 1 — one element past the end of lambda[] (which is sized nroots + 1, valid indices 0..nroots). The out-of-bounds write lands on syn[0], corrupting the syndrome buffer.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Aug 19, 2026 | Aug 15, 2026 |
| Rocky_linux | — | Upgrade kernel-modules-coreUpgrade rtlaUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debugUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-develUpgrade kernel-develUpgrade python3-perf-debuginfoUpgrade kernel-zfcpdump-develUpgrade kernel-modulesUpgrade kernel-debug-uki-virtUpgrade kernel-rt-modules-coreUpgrade perf-debuginfoUpgrade kernel-modules-extra-matchedUpgrade bpftoolUpgrade kernel-rt-coreUpgrade kernel-modules-extraUpgrade kernel-tools-debuginfoUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debug-modules-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-modules-coreUpgrade kernel-rt-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-debuginfoUpgrade kernel-coreUpgrade kernel-rt-develUpgrade kernel-zfcpdumpUpgrade kernel-debug-develUpgrade kernel-debug-debuginfoUpgrade kernel-debugUpgrade kernel-uki-virtUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-debug-coreUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade kernel-rt-debug-kvmUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernel-debug-devel-matchedUpgrade libperfUpgrade kernelUpgrade rvUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-tools-libs-develUpgrade kernel-rtUpgrade kernel-zfcpdump-coreUpgrade kernel-devel-matchedUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-zfcpdump-debuginfoUpgrade perfUpgrade kernel-uki-virt-addonsUpgrade kernel-debuginfo-common-s390xUpgrade kernel-rt-kvmUpgrade python3-perfUpgrade libperf-debuginfoUpgrade kernel-rt-modules-extra | Sep 15, 2026 | Sep 10, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub