CVE-2026-19617: Allocation of Resources Without Limits or Throttling in Red Hat Red Hat Enterprise Linux 10
CVE-2026-19617 is a vulnerability in the libdm component of Red Hat Enterprise Linux 10. It allows a remote attacker to craft malicious LVM metadata with deeply nested structures, causing uncontrolled recursion in the libdm configuration parser. This leads to stack exhaustion and crashes of any LVM command reading the metadata, resulting in a denial of service (DoS). The vulnerability has a medium severity with a CVSS score of 5.7. No official patch or fix status is currently confirmed by Red Hat.
AI Analysis
Technical Summary
This vulnerability affects the libdm library used by Logical Volume Manager (LVM) in Red Hat Enterprise Linux 10. An attacker can create a specially crafted LVM metadata configuration containing deeply nested structures that trigger uncontrolled recursion in the libdm configuration file parser. This recursion exhausts the stack memory, causing LVM commands that read the metadata to crash, resulting in a denial of service condition. The issue is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The CVSS v3.1 base score is 5.7 with local attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity at a low level with no availability impact. Red Hat's advisory does not currently indicate an available patch or fix, and the vulnerability is under investigation for affected versions and remediation.
Potential Impact
The vulnerability allows a local attacker to cause a denial of service by crashing LVM commands that read maliciously crafted metadata. This can disrupt system management operations involving LVM, potentially affecting system stability and availability of volume management functions. There is no indication of confidentiality or integrity compromise beyond low impact, and no known exploits in the wild have been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-19617 for current remediation guidance. Until an official fix is released, no specific mitigation actions are documented by Red Hat. Users should monitor the vendor advisory for updates and consider limiting access to LVM metadata configuration files to trusted users only.
CVE-2026-19617: Allocation of Resources Without Limits or Throttling in Red Hat Red Hat Enterprise Linux 10
Description
CVE-2026-19617 is a vulnerability in the libdm component of Red Hat Enterprise Linux 10. It allows a remote attacker to craft malicious LVM metadata with deeply nested structures, causing uncontrolled recursion in the libdm configuration parser. This leads to stack exhaustion and crashes of any LVM command reading the metadata, resulting in a denial of service (DoS). The vulnerability has a medium severity with a CVSS score of 5.7. No official patch or fix status is currently confirmed by Red Hat.
CVSS v3.1
Score 5.7medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects the libdm library used by Logical Volume Manager (LVM) in Red Hat Enterprise Linux 10. An attacker can create a specially crafted LVM metadata configuration containing deeply nested structures that trigger uncontrolled recursion in the libdm configuration file parser. This recursion exhausts the stack memory, causing LVM commands that read the metadata to crash, resulting in a denial of service condition. The issue is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The CVSS v3.1 base score is 5.7 with local attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity at a low level with no availability impact. Red Hat's advisory does not currently indicate an available patch or fix, and the vulnerability is under investigation for affected versions and remediation.
Potential Impact
The vulnerability allows a local attacker to cause a denial of service by crashing LVM commands that read maliciously crafted metadata. This can disrupt system management operations involving LVM, potentially affecting system stability and availability of volume management functions. There is no indication of confidentiality or integrity compromise beyond low impact, and no known exploits in the wild have been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-19617 for current remediation guidance. Until an official fix is released, no specific mitigation actions are documented by Red Hat. Users should monitor the vendor advisory for updates and consider limiting access to LVM metadata configuration files to trusted users only.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-08-12T13:42:07.874Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-19617","vendor":"Red Hat"}]
Threat ID: 6a7eb1a0bf8831d5398754c9
Added to database: 08/14/2026, 06:11:44 UTC
Last enriched: 08/14/2026, 06:30:24 UTC
Last updated: 08/14/2026, 06:35:15 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.