CVE-2026-19617
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A flaw was found in the libdm library that allows a local attacker to craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This can lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the metadata to crash. This vulnerability results in a Denial of Service (DoS) for affected systems.
Risk Assessment
An attacker can cause LVM commands to crash, leading to unavailability of services that depend on logical volume management. This can disrupt production systems and require manual administrator intervention.
Recommendation
Apply patches provided by the distribution or libdm vendor. Restrict local access to systems to reduce the risk of exploitation.
Original NVD description (English source)
A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the metadata to crash. This vulnerability results in a Denial of Service (DoS) for affected systems.