CVE-2026-19617
Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser
A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the metadata to crash. This vulnerability results in a Denial of Service (DoS) for affected systems.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser
A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the metadata to crash. This vulnerability results in a Denial of Service (DoS) for affected systems.
- Record
CVE-2026-19617- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-05
EUVDEUVD-2026-58594
A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the metadata to crash. This vulnerability results in a Denial of Service (DoS) for affected systems.
- Record
EUVD-2026-58594- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-2f2v-c79p-8x4x
A flaw was found in libdm. A remote attacker could craft a malicious Logical Volume Manager (LVM)...
A flaw was found in libdm. A remote attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the metadata to crash. This vulnerability results in a Denial of Service (DoS) for affected systems.
- Record
GHSA-2f2v-c79p-8x4x- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-770
- Updated
- 2026-11-02
NVD
A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the metadata to crash. This vulnerability results in a Denial of Service (DoS) for affected systems.
- Record
CVE-2026-19617- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-05
OSVDEBIAN-CVE-2026-19617
A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the metadata to crash. This vulnerability results in a Denial of Service (DoS) for affected systems.
- Record
DEBIAN-CVE-2026-19617- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:73989
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:73989- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-19617
A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the metadata to crash. This vulnerability results in a Denial of Service (DoS) for affected systems.
- Record
UBUNTU-CVE-2026-19617- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-96698 No score
CVE-2026-19617 affecting package lvm2 2.03.23-1
A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the metadata to crash. This vulnerability results in a Denial of Service (DoS) for affected systems.
- Record
AZL-96698- Updated
- 2026-11-05
Affected products
- red hat enterprise linux 10
- red hat enterprise linux 6
- red hat enterprise linux 7
- red hat enterprise linux 8
- red hat enterprise linux 9
- red hat hardened images
- red hat openshift container platform 4
- red hat openshift container platform 5
- redhat enterprise linux
- redhat hardened images
- redhat openshift container platform
Affected packages
| Package | Affected | Fixed |
|---|---|---|
lvm2Azure Linux:3 |
through 2.03.23-1 | None known |
lvm2Debian:12 |
All versions, plus listed versions 2.03.16-22.03.16-32.03.22-12.03.27-12.03.31-12.03.31-2 |
None known |
lvm2Debian:13 |
All versions, plus listed versions 2.03.31-2 |
None known |
lvm2Debian:14 |
All versions, plus listed versions 2.03.31-2 |
None known |
lvm2Red Hat:hummingbird:1 |
before 0:2.03.43-1.hum1 | 0:2.03.43-1.hum1 |
lvm2-dbusdRed Hat:hummingbird:1 |
before 0:2.03.43-1.hum1 | 0:2.03.43-1.hum1 |
lvm2-develRed Hat:hummingbird:1 |
before 0:2.03.43-1.hum1 | 0:2.03.43-1.hum1 |
lvm2-libsRed Hat:hummingbird:1 |
before 0:2.03.43-1.hum1 | 0:2.03.43-1.hum1 |
lvm2-lockdRed Hat:hummingbird:1 |
before 0:2.03.43-1.hum1 | 0:2.03.43-1.hum1 |
lvm2-testsuiteRed Hat:hummingbird:1 |
before 0:2.03.43-1.hum1 | 0:2.03.43-1.hum1 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
lvm2Ubuntu:14.04:LTS |
All versions, plus listed versions 2.02.98-6ubuntu12.02.98-6ubuntu2 |
None known |
lvm2Ubuntu:16.04:LTS |
All versions, plus listed versions 2.02.122-1ubuntu12.02.133-1ubuntu12.02.133-1ubuntu22.02.133-1ubuntu32.02.133-1ubuntu4 Show 5 moreShow less2.02.133-1ubuntu52.02.133-1ubuntu72.02.133-1ubuntu82.02.133-1ubuntu92.02.133-1ubuntu10 |
None known |
lvm2Ubuntu:18.04:LTS |
All versions, plus listed versions 2.02.168-2ubuntu32.02.176-4.1ubuntu22.02.176-4.1ubuntu32.02.176-4.1ubuntu3.18.04.12.02.176-4.1ubuntu3.18.04.22.02.176-4.1ubuntu3.18.04.3 |
None known |
lvm2Ubuntu:20.04:LTS |
All versions, plus listed versions 2.03.02-2ubuntu62.03.02-2ubuntu72.03.02-2ubuntu82.03.07-1ubuntu1 |
None known |
lvm2Ubuntu:22.04:LTS |
All versions, plus listed versions 2.03.11-2.1ubuntu32.03.11-2.1ubuntu42.03.11-2.1ubuntu5 |
None known |
lvm2Ubuntu:24.04:LTS |
All versions, plus listed versions 2.03.16-2ubuntu12.03.16-3ubuntu12.03.16-3ubuntu22.03.16-3ubuntu32.03.16-3ubuntu3.12.03.16-3ubuntu3.2 |
None known |
lvm2Ubuntu:26.10 |
All versions, plus listed versions 2.03.31-2ubuntu32.03.31-2ubuntu4 |
None known |
lvm2Ubuntu:26.04:LTS |
All versions, plus listed versions 2.03.31-2ubuntu22.03.31-2ubuntu3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| products | CVE List, EUVD | |
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-19617 is a medium vulnerability (CVSS 5.5) in Red Hat Enterprise Linux 10, published August 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 4th percentile. Fixed in lvm2 0:2.03.43-1.hum1.