HighFix available
dm-log: fix a bitset_size overflow on 32bit machines
Type: advisorySources: OSV
In the Linux kernel, the following vulnerability has been resolved: dm-log: fix a bitset_size overflow on 32bit machines Commit c20e36b7631d ("dm log: fix out-of-bounds write due to region_count overflow") made sure that region_count could fit in an unsigned int. But the bitmap memory isn't allocated based on region_count. It uses bitset_size (a size_t variable). The first step of calculating bitset_size is to set it to region_count, rounded up to a multiple of BITS_PER_LONG. If region_size is less than BITS_PER_LONG smaller than UINT_MAX, it will get rounded up to 2^32. On a 32bit architecture, this will make bitset_size wrap around to 0 and fail, despite region_count being valid. Since bitset_size gets divided by 8, it can hold any valid region_count. It just needs a special case to handle the rollover. If it is 0, the value rolled over, and bitset size should be set to the number of bytes needed to hold 2^32 bits.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.261, 5.15.212, 6.1.178, 6.12.97, 6.18.40, 6.6.145, 7.1.5
- CVEs
- CVE-2026-72105
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 10:14 UTC · Revision 1
Source evidence
dm-log: fix a bitset_size overflow on 32bit machines
core-osv · Original sourcePublished 15 Aug 2026, 05:52 UTC
In the Linux kernel, the following vulnerability has been resolved: dm-log: fix a bitset_size overflow on 32bit machines Commit c20e36b7631d ("dm log: fix out-of-bounds write due to region_count overflow") made sure that region_count could fit in an unsigned int. But the bitmap memory isn't allocated based on region_count. It uses bitset_size (a size_t variable). The first step of calculating bitset_size is to set it to region_count, rounded up to a multiple of BITS_PER_LONG. If region_size is less than BITS_PER_LONG smaller than UINT_MAX, it will get rounded up to 2^32. On a 32bit architecture, this will make bitset_size wrap around to 0 and fail, despite region_count being valid. Since bitset_size gets divided by 8, it can hold any valid region_count. It just needs a special case to handle the rollover. If it is 0, the value rolled over, and bitset size should be set to the number of bytes needed to hold 2^32 bits.
osv:CVE-2026-72105
Kernel
Fixed versions: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5
Complete source record
{
"id": "0344e1b2df09f08bc4f35a042b5c5e5a52a4cd06f17226f08516a57c8bf4b30c",
"url": "https://osv.dev/vulnerability/CVE-2026-72105",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "dm-log: fix a bitset_size overflow on 32bit machines",
"summary": "In the Linux kernel, the following vulnerability has been resolved: dm-log: fix a bitset_size overflow on 32bit machines Commit c20e36b7631d (\"dm log: fix out-of-bounds write due to region_count overflow\") made sure that region_count could fit in an unsigned int. But the bitmap memory isn't allocated based on region_count. It uses bitset_size (a size_t variable). The first step of calculating bitset_size is to set it to region_count, rounded up to a multiple of BITS_PER_LONG. If region_size is less than BITS_PER_LONG smaller than UINT_MAX, it will get rounded up to 2^32. On a 32bit architecture, this will make bitset_size wrap around to 0 and fail, despite region_count being valid. Since bitset_size gets divided by 8, it can hold any valid region_count. It just needs a special case to handle the rollover. If it is 0, the value rolled over, and bitset size should be set to the number of bytes needed to hold 2^32 bits.",
"evidence": "osv:CVE-2026-72105",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.10.261",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.212",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.178",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.145",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.97",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.40",
"evidence": "/affected/1/ranges"
},
{
"value": "7.1.5",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "CVE-2026-72105",
"aliases": [
"CVE-2026-72105"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "44ab8875ae4a2842bde2d756bed195d375e0debb"
},
{
"fixed": "cdc4ddf9db2cb79f4ab86b1a509b7ac21b0b6cf5"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "defe483e47173768c227532694dc78cb65db5f09"
},
{
"fixed": "4b0de5a3ac1fd42acb0dc1f80ac5747e3287d723"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "3ec74da927b4e171a6fc0e77b1188ba4d019af51"
},
{
"fixed": "567602fa72d57169365cbc589e0b8c3be900636d"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "d4ac87567f86a55c3c92e9a5144dcd943a9772a1"
},
{
"fixed": "d05e0edfecf5260e6dddd28b2f0cce02bfc6ed7a"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "12bd5b88e91a02785244ff1d20fb157e96e9cdc8"
},
{
"fixed": "1c3412b584e1fb6c665ff33ba7259253bc0082cb"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "b455903eed4558982be0811f5b7f44f6bbc4ff57"
},
{
"fixed": "e0b0163a65758ec3a2361ae1cea407898c27f21e"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "c20e36b7631d83e7535877f08af8b0af72c44b1a"
},
{
"fixed": "79feb87ab2396d49b9b65e4bb815d33cc71cba47"
},
{
"fixed": "9743132a41f4d9d0e54c5f2adcb821b04796bab1"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.10.258"
},
{
"fixed": "5.10.261"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.15.209"
},
{
"fixed": "5.15.212"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.1.175"
},
{
"fixed": "6.1.178"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.6.141"
},
{
"fixed": "6.6.145"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.12.91"
},
{
"fixed": "6.12.97"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.18.33"
},
{
"fixed": "6.18.40"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "7.0.10"
},
{
"fixed": "7.1"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "4ec8323b9f0764a14d532b1ae9b87f8a9fecb867"
}
]
}
],
"versions": [
"v5.10.260",
"v5.10.259",
"v5.10.258",
"v5.15.211",
"v5.15.210",
"v5.15.209",
"v6.1.177",
"v6.1.176",
"v6.1.175",
"v6.6.144",
"v6.6.143",
"v6.6.142",
"v6.6.141",
"v6.12.96",
"v6.12.95",
"v6.12.94",
"v6.12.93",
"v6.12.92",
"v6.12.91",
"v6.18.39",
"v6.18.38",
"v6.18.37",
"v6.18.36",
"v6.18.35",
"v6.18.34",
"v6.18.33",
"v7.0.14",
"v7.0.13",
"v7.0.12",
"v7.0.11",
"v7.0.10"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72105.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.10.261"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.212"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.178"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.145"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.97"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.40"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "7.1.5"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72105.json"
}
}
],
"modified": "2026-10-28T02:30:50.307909536Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/1c3412b584e1fb6c665ff33ba7259253bc0082cb",
"https://git.kernel.org/stable/c/4b0de5a3ac1fd42acb0dc1f80ac5747e3287d723",
"https://git.kernel.org/stable/c/567602fa72d57169365cbc589e0b8c3be900636d",
"https://git.kernel.org/stable/c/79feb87ab2396d49b9b65e4bb815d33cc71cba47",
"https://git.kernel.org/stable/c/9743132a41f4d9d0e54c5f2adcb821b04796bab1",
"https://git.kernel.org/stable/c/cdc4ddf9db2cb79f4ab86b1a509b7ac21b0b6cf5",
"https://git.kernel.org/stable/c/d05e0edfecf5260e6dddd28b2f0cce02bfc6ed7a",
"https://git.kernel.org/stable/c/e0b0163a65758ec3a2361ae1cea407898c27f21e",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72105.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-72105",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72105.json"
}
},
"related_cves": [
{
"value": "CVE-2026-72105",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 518975,
"published_at": "2026-08-15T05:52:48.099+00:00"
}