This vulnerability involves uncontrolled recursion in the libdm configuration file parser triggered by deeply nested LVM metadata configurations crafted by a local attacker. The recursion exhausts the stack, causing any LVM command that reads the malicious metadata to crash, resulting in a denial of service. The flaw requires local access with the ability to create or modify LVM metadata. It primarily affects systems where untrusted users have write permissions on LVM metadata or underlying block devices. The vulnerability is tracked as CVE-2026-19617 and has a CVSS v3.1 score of 5.5 (medium severity).

The impact is a denial of service condition caused by stack exhaustion due to uncontrolled recursion in the libdm parser. This disrupts LVM commands that read the malicious metadata, potentially affecting system availability. There is no confidentiality or integrity impact. The vulnerability requires local access with write permissions to LVM metadata, limiting the attack surface to systems where untrusted users can modify such metadata.

Red Hat advises avoiding importing LVM physical volumes from untrusted sources without inspecting the metadata first. Systems using LVM on shared or externally-attached storage should ensure that only trusted administrators have write access to the underlying block devices. No official patch or fix is currently confirmed; check the Red Hat advisory for updates. Restricting write access to LVM metadata is the primary mitigation.