01 Record

CVE-2026-72105

dm-log: fix a bitset_size overflow on 32bit machines

HighPUBLISHEDCNA: Linux

CNA base score7.8 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

dm-log: fix a bitset_size overflow on 32bit machines

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.16% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 5.7% of scored records. A rank, not a probability.

NVD base score

7.8 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Received. NVD last modified this record on 2026-10-19.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-08-15 05:52Z2 MO AGO

Last updated

2026-10-19 21:19Z9 DAYS AGO

Reserved

2026-08-09

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 7.8)

CNA CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-190Integer Overflow or WraparoundBase

Data version

5.2

Document digest

47cf07465535f91e8f9b1b9aded9da20368cc8f1a7ffa2a17cb96e0e4d1a921c

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux44ab8875ae4a2842bde2d756bed195d375e0debb to < cdc4ddf9db2cb79f4ab86b1a509b7ac21b0b6cf5, defe483e47173768c227532694dc78cb65db5f09 to < 4b0de5a3ac1fd42acb0dc1f80ac5747e3287d723, 3ec74da927b4e171a6fc0e77b1188ba4d019af51 to < 567602fa72d57169365cbc589e0b8c3be900636d, d4ac87567f86a55c3c92e9a5144dcd943a9772a1 to < d05e0edfecf5260e6dddd28b2f0cce02bfc6ed7a, 12bd5b88e91a02785244ff1d20fb157e96e9cdc8 to < 1c3412b584e1fb6c665ff33ba7259253bc0082cb, b455903eed4558982be0811f5b7f44f6bbc4ff57 to < e0b0163a65758ec3a2361ae1cea407898c27f21e, c20e36b7631d83e7535877f08af8b0af72c44b1a to < 79feb87ab2396d49b9b65e4bb815d33cc71cba47, c20e36b7631d83e7535877f08af8b0af72c44b1a to < 9743132a41f4d9d0e54c5f2adcb821b04796bab1, 4ec8323b9f0764a14d532b1ae9b87f8a9fecb867, 5.10.258 to < 5.10.261, 5.15.209 to < 5.15.212, 6.1.175 to < 6.1.178, 6.6.141 to < 6.6.145, 6.12.91 to < 6.12.97, 6.18.33 to < 6.18.40, 7.0.10 to < 7.1, 7.1—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/cdc4ddf9db2cb79f4ab86b1a509b7ac21b0b6cf5
git.kernel.orghttps://git.kernel.org/stable/c/4b0de5a3ac1fd42acb0dc1f80ac5747e3287d723
git.kernel.orghttps://git.kernel.org/stable/c/567602fa72d57169365cbc589e0b8c3be900636d
git.kernel.orghttps://git.kernel.org/stable/c/d05e0edfecf5260e6dddd28b2f0cce02bfc6ed7a
git.kernel.orghttps://git.kernel.org/stable/c/1c3412b584e1fb6c665ff33ba7259253bc0082cb
git.kernel.orghttps://git.kernel.org/stable/c/e0b0163a65758ec3a2361ae1cea407898c27f21e
git.kernel.orghttps://git.kernel.org/stable/c/79feb87ab2396d49b9b65e4bb815d33cc71cba47
git.kernel.orghttps://git.kernel.org/stable/c/9743132a41f4d9d0e54c5f2adcb821b04796bab1

07 Fixed in

Debian 12

linux
Fixed in 6.1.180-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.100-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 7.1.5-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.