Description
In the Linux kernel, the following vulnerability has been resolved:

dm log: fix out-of-bounds write due to region_count overflow

The local variable region_count in create_log_context() is declared as
unsigned int (32-bit), but dm_sector_div_up() returns sector_t (64-bit).
When a device-mapper target has a sufficiently large ti->len with a small
region_size, the division result can exceed UINT_MAX. The truncated
value is then used to calculate bitset_size, causing clean_bits,
sync_bits, and recovering_bits to be allocated far smaller than needed
for the actual number of regions.

Subsequent log operations (log_set_bit, log_clear_bit, log_test_bit) use
region indices derived from the full untruncated region space, causing
out-of-bounds writes to kernel heap memory allocated by vmalloc.

This can be reproduced by creating a mirror target whose region_count
overflows 32 bits:

dmsetup create bigzero --table '0 8589934594 zero'
dmsetup create mymirror --table '0 8589934594 mirror \
core 2 2 nosync 2 /dev/mapper/bigzero 0 \
/dev/mapper/bigzero 0'

The status output confirms the truncation (sync_count=1 instead of
4294967297, because 0x100000001 was truncated to 1):

$ dmsetup status mymirror
0 8589934594 mirror 2 254:1 254:1 1/4294967297 ...

This leads to a kernel crash in core_in_sync:

BUG: scheduling while atomic: (udev-worker)/9150/0x00000000
RIP: 0010:core_in_sync+0x14/0x30 [dm_log]
CR2: 0000000000000008
Fixing recursive fault but reboot is needed!

Fix by widening the local region_count to sector_t and adding an
explicit overflow check before the value is assigned to lc->region_count.
Published: 2026-06-24
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4664-1 linux security update
Debian DLA Debian DLA DLA-4665-1 linux security update
Debian DLA Debian DLA DLA-4671-1 linux-6.1 security update
Ubuntu USN Ubuntu USN USN-8566-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8567-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8568-1 Linux kernel (OEM) vulnerabilities
Ubuntu USN Ubuntu USN USN-8569-1 Linux kernel (HWE) vulnerabilities
Ubuntu USN Ubuntu USN USN-8574-1 Linux kernel (GCP FIPS) vulnerabilities
Ubuntu USN Ubuntu USN USN-8575-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8576-1 Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN Ubuntu USN USN-8593-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8574-2 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8595-1 Linux kernel (Oracle) vulnerabilities
Ubuntu USN Ubuntu USN USN-8596-1 Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN Ubuntu USN USN-8575-2 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8576-2 Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN Ubuntu USN USN-8575-3 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8595-2 Linux kernel (AWS) vulnerabilities
Ubuntu USN Ubuntu USN USN-8603-1 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-8606-1 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-8607-1 Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN Ubuntu USN USN-8608-1 Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN Ubuntu USN USN-8609-1 Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN Ubuntu USN USN-8610-1 Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN Ubuntu USN USN-8574-3 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8595-3 Linux kernel (AWS) vulnerabilities
Ubuntu USN Ubuntu USN USN-8618-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8619-1 Linux kernel (HWE) vulnerabilities
Ubuntu USN Ubuntu USN USN-8620-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8620-2 Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN Ubuntu USN USN-8620-3 Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN Ubuntu USN USN-8620-4 Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN Ubuntu USN USN-8663-1 Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN Ubuntu USN USN-8664-1 Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN Ubuntu USN USN-8665-1 Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN Ubuntu USN USN-8668-1 Linux kernel (GCP) vulnerabilities
References
Link Providers
https://access.redhat.com/errata/RHSA-2026:45114 cve-icon
https://access.redhat.com/errata/RHSA-2026:45115 cve-icon
https://access.redhat.com/errata/RHSA-2026:45116 cve-icon
https://access.redhat.com/errata/RHSA-2026:45192 cve-icon
https://access.redhat.com/errata/RHSA-2026:47248 cve-icon
https://access.redhat.com/errata/RHSA-2026:52649 cve-icon
https://access.redhat.com/errata/RHSA-2026:53989 cve-icon
https://access.redhat.com/errata/RHSA-2026:55445 cve-icon
https://access.redhat.com/errata/RHSA-2026:56574 cve-icon
https://access.redhat.com/errata/RHSA-2026:59662 cve-icon
https://access.redhat.com/errata/RHSA-2026:59663 cve-icon
https://access.redhat.com/security/cve/CVE-2026-53059 cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2492277 cve-icon
https://git.kernel.org/stable/c/12bd5b88e91a02785244ff1d20fb157e96e9cdc8 cve-icon cve-icon
https://git.kernel.org/stable/c/3ec74da927b4e171a6fc0e77b1188ba4d019af51 cve-icon cve-icon
https://git.kernel.org/stable/c/44ab8875ae4a2842bde2d756bed195d375e0debb cve-icon cve-icon
https://git.kernel.org/stable/c/4ec8323b9f0764a14d532b1ae9b87f8a9fecb867 cve-icon cve-icon
https://git.kernel.org/stable/c/b455903eed4558982be0811f5b7f44f6bbc4ff57 cve-icon cve-icon
https://git.kernel.org/stable/c/c20e36b7631d83e7535877f08af8b0af72c44b1a cve-icon cve-icon
https://git.kernel.org/stable/c/d4ac87567f86a55c3c92e9a5144dcd943a9772a1 cve-icon cve-icon
https://git.kernel.org/stable/c/defe483e47173768c227532694dc78cb65db5f09 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2026062401-CVE-2026-53059-f32e@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-53059 cve-icon
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53059.json cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-53059 cve-icon
History

Wed, 26 Aug 2026 15:45:00 +0000


Wed, 19 Aug 2026 12:30:00 +0000

Type Values Removed Values Added
References

Mon, 17 Aug 2026 12:30:00 +0000

Type Values Removed Values Added
References

Wed, 12 Aug 2026 12:30:00 +0000

Type Values Removed Values Added
References

Fri, 26 Jun 2026 04:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-122
CWE-680

Fri, 26 Jun 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-190
References
Metrics threat_severity

None

cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Important


Wed, 24 Jun 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-122
CWE-680

Wed, 24 Jun 2026 17:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: dm log: fix out-of-bounds write due to region_count overflow The local variable region_count in create_log_context() is declared as unsigned int (32-bit), but dm_sector_div_up() returns sector_t (64-bit). When a device-mapper target has a sufficiently large ti->len with a small region_size, the division result can exceed UINT_MAX. The truncated value is then used to calculate bitset_size, causing clean_bits, sync_bits, and recovering_bits to be allocated far smaller than needed for the actual number of regions. Subsequent log operations (log_set_bit, log_clear_bit, log_test_bit) use region indices derived from the full untruncated region space, causing out-of-bounds writes to kernel heap memory allocated by vmalloc. This can be reproduced by creating a mirror target whose region_count overflows 32 bits: dmsetup create bigzero --table '0 8589934594 zero' dmsetup create mymirror --table '0 8589934594 mirror \ core 2 2 nosync 2 /dev/mapper/bigzero 0 \ /dev/mapper/bigzero 0' The status output confirms the truncation (sync_count=1 instead of 4294967297, because 0x100000001 was truncated to 1): $ dmsetup status mymirror 0 8589934594 mirror 2 254:1 254:1 1/4294967297 ... This leads to a kernel crash in core_in_sync: BUG: scheduling while atomic: (udev-worker)/9150/0x00000000 RIP: 0010:core_in_sync+0x14/0x30 [dm_log] CR2: 0000000000000008 Fixing recursive fault but reboot is needed! Fix by widening the local region_count to sector_t and adding an explicit overflow check before the value is assigned to lc->region_count.
Title dm log: fix out-of-bounds write due to region_count overflow
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-26T12:04:47.682Z

Reserved: 2026-06-09T07:44:35.382Z

Link: CVE-2026-53059

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2026-06-24T17:17:18.463

Modified: 2026-08-26T13:19:14.570

Link: CVE-2026-53059

cve-icon Redhat

Severity : Important

Publid Date: 2026-06-24T00:00:00Z

Links: CVE-2026-53059 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-12T07:00:12Z

Weaknesses