CVE-2026-19617CWE-770denial-of-service

CVE-2026-19617

Medium · published August 14, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
4.6
In the wild
Unconfirmed
What it is

A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the metadata to crash. This vulnerability results in a Denial of Service (DoS) for affected systems.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00158 · 4.6th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-08-14T10:17Z
Affected products (7)
ProductVersionsFixed in
redhat/hardened_imagesall versions—
redhat/openshift_container_platformall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
References (3)
https://access.redhat.com/errata/RHSA-2026:73989 · [email protected]https://access.redhat.com/security/cve/CVE-2026-19617 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2514626 · [email protected]
EPSS history
Timeline
  • 14 AUG 05:59Z
    Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser
    cvelistv5