{"id":"CVE-2026-110036","aliases":["EUVD-2026-99241","GHSA-ch68-jhcq-2942"],"status":"published","title":"Device-mapper-persistent-data: device-mapper-persistent-data: denial of service via crafted block indices","description":"A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service (DoS) by inducing a user or system tool to process crafted device metadata containing an excessively large block index. An arithmetic error in the synchronous block reading logic causes the application to panic and unexpectedly terminate.","severity":{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00184,"percentile":0.08102,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-190"],"published":"2026-10-13T18:45:47Z","modified":"2026-11-06T17:50:37Z","products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 5"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-110036","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2474403","tags":["issue-tracking","x_refsource_REDHAT","exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110036"},{"url":"https://github.com/advisories/GHSA-ch68-jhcq-2942"}],"sources":{"cve":[{"id":"CVE-2026-110036","title":"Device-mapper-persistent-data: device-mapper-persistent-data: denial of service via crafted block indices","description":"A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service (DoS) by inducing a user or system tool to process crafted device metadata containing an excessively large block index. An arithmetic error in the synchronous block reading logic causes the application to panic and unexpectedly terminate.","status":"published","published":"2026-10-13T18:45:47.168Z","modified":"2026-11-06T17:50:37.842Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-190"],"updated_at":"2026-11-06T18:59:07.714367Z"}],"euvd":[{"id":"EUVD-2026-99241","description":"A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service (DoS) by inducing a user or system tool to process crafted device metadata containing an excessively large block index. An arithmetic error in the synchronous block reading logic causes the application to panic and unexpectedly terminate.","status":"published","published":"2026-10-13T18:45:47Z","modified":"2026-11-06T17:50:37Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-06T19:05:53.354277Z"}],"ghsa":[{"id":"GHSA-ch68-jhcq-2942","title":"A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service...","description":"A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service (DoS) by inducing a user or system tool to process crafted device metadata containing an excessively large block index. An arithmetic error in the synchronous block reading logic causes the application to panic and unexpectedly terminate.","status":"published","published":"2026-10-13T21:33:32Z","modified":"2026-10-13T21:33:37Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:13:13.94868Z"}],"nvd":[{"id":"CVE-2026-110036","description":"A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service (DoS) by inducing a user or system tool to process crafted device metadata containing an excessively large block index. An arithmetic error in the synchronous block reading logic causes the application to panic and unexpectedly terminate.","status":"published","published":"2026-10-13T19:18:42.963Z","modified":"2026-11-06T18:17:44.237Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"}],"cwes":["CWE-190"],"updated_at":"2026-11-06T20:01:13.883836Z"}]}}