CVE-2026-19617

EUVD-2026-58594
A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the metadata to crash. This vulnerability results in a Denial of Service (DoS) for affected systems.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.5 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 5.02%
Affected Products (NVD)
VendorProductVersion
redhathardened_images
-
redhatopenshift_container_platform
4.0
redhatenterprise_linux
6.0
redhatenterprise_linux
7.0
redhatenterprise_linux
8.0
redhatenterprise_linux
9.0
redhatenterprise_linux
10.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
lvm2
bookworm
unimportant
forky
unimportant
sid
unimportant
trixie
unimportant
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
lvm2
bionic
deferred
focal
deferred
jammy
deferred
noble
deferred
resolute
deferred
trusty
deferred
xenial
deferred
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
cmirror
Amazon Linux 2
7:2.02.187-6.amzn2.5.2
fixed
cmirror-standalone
Amazon Linux 2
7:2.02.187-6.amzn2.5.2
fixed
device-mapper
Amazon Linux 2
7:1.02.170-6.amzn2.5.2
fixed
Amazon Linux 2023
0:1.02.185-1.amzn2023.0.6
fixed
device-mapper-debuginfo
Amazon Linux 2023
0:1.02.185-1.amzn2023.0.6
fixed
device-mapper-devel
Amazon Linux 2
7:1.02.170-6.amzn2.5.2
fixed
Amazon Linux 2023
0:1.02.185-1.amzn2023.0.6
fixed
device-mapper-event
Amazon Linux 2
7:1.02.170-6.amzn2.5.2
fixed
Amazon Linux 2023
0:1.02.185-1.amzn2023.0.6
fixed
device-mapper-event-debuginfo
Amazon Linux 2023
0:1.02.185-1.amzn2023.0.6
fixed
device-mapper-event-devel
Amazon Linux 2
7:1.02.170-6.amzn2.5.2
fixed
Amazon Linux 2023
0:1.02.185-1.amzn2023.0.6
fixed
device-mapper-event-libs
Amazon Linux 2
7:1.02.170-6.amzn2.5.2
fixed
Amazon Linux 2023
0:1.02.185-1.amzn2023.0.6
fixed
device-mapper-event-libs-debuginfo
Amazon Linux 2023
0:1.02.185-1.amzn2023.0.6
fixed
device-mapper-libs
Amazon Linux 2
7:1.02.170-6.amzn2.5.2
fixed
Amazon Linux 2023
0:1.02.185-1.amzn2023.0.6
fixed
device-mapper-libs-debuginfo
Amazon Linux 2023
0:1.02.185-1.amzn2023.0.6
fixed
lvm2
Amazon Linux 2
7:2.02.187-6.amzn2.5.2
fixed
Amazon Linux 2023
0:2.03.16-1.amzn2023.0.6
fixed
lvm2-cluster
Amazon Linux 2
7:2.02.187-6.amzn2.5.2
fixed
lvm2-cluster-standalone
Amazon Linux 2
7:2.02.187-6.amzn2.5.2
fixed
lvm2-dbusd
Amazon Linux 2023
0:2.03.16-1.amzn2023.0.6
fixed
lvm2-debuginfo
Amazon Linux 2
7:2.02.187-6.amzn2.5.2
fixed
Amazon Linux 2023
0:2.03.16-1.amzn2023.0.6
fixed
lvm2-debugsource
Amazon Linux 2023
0:2.03.16-1.amzn2023.0.6
fixed
lvm2-devel
Amazon Linux 2
7:2.02.187-6.amzn2.5.2
fixed
Amazon Linux 2023
0:2.03.16-1.amzn2023.0.6
fixed
lvm2-libs
Amazon Linux 2
7:2.02.187-6.amzn2.5.2
fixed
Amazon Linux 2023
0:2.03.16-1.amzn2023.0.6
fixed
lvm2-libs-debuginfo
Amazon Linux 2023
0:2.03.16-1.amzn2023.0.6
fixed
lvm2-lockd
Amazon Linux 2
7:2.02.187-6.amzn2.5.2
fixed
Amazon Linux 2023
0:2.03.16-1.amzn2023.0.6
fixed
lvm2-lockd-debuginfo
Amazon Linux 2023
0:2.03.16-1.amzn2023.0.6
fixed
lvm2-python-boom
Amazon Linux 2
7:1.2-2.amzn2.5.2
fixed
lvm2-python-libs
Amazon Linux 2
7:2.02.187-6.amzn2.5.2
fixed
lvm2-sysvinit
Amazon Linux 2
7:2.02.187-6.amzn2.5.2
fixed
lvm2-testsuite
Amazon Linux 2023
0:2.03.16-1.amzn2023.0.6
fixed
lvm2-testsuite-debuginfo
Amazon Linux 2023
0:2.03.16-1.amzn2023.0.6
fixed
Common Weakness Enumeration
References
https://access.redhat.com/errata/RHSA-2026:73989
https://access.redhat.com/security/cve/CVE-2026-19617
https://bugzilla.redhat.com/show_bug.cgi?id=2514626