The Linux kernel's dm_log component had a vulnerability where the local variable region_count, declared as a 32-bit unsigned int, was assigned a truncated 32-bit value from a 64-bit division result (sector_t) when calculating the number of regions for device-mapper targets. This truncation caused the allocated bitsets (clean_bits, sync_bits, recovering_bits) to be smaller than required, leading to out-of-bounds writes during log operations that use full 64-bit region indices. This memory corruption can cause kernel crashes, as demonstrated by creating a mirror target with a region_count overflow. The fix involved changing region_count to sector_t and adding an overflow check before assignment.

The vulnerability can cause out-of-bounds writes to kernel heap memory, leading to kernel crashes and potential denial of service. The CVSS 3.1 vector rates it as high severity with impact on confidentiality, integrity, and availability (C:H/I:H/A:H). There is no indication of known exploits in the wild. The flaw affects systems using device-mapper targets with very large sizes and small region sizes, which can trigger the overflow condition.

A security update fixing this vulnerability is available from Red Hat for Red Hat Enterprise Linux 8.4 Extended Life Cycle and AUS variants. The fix includes widening the region_count variable and adding overflow checks. Users should apply the kernel update provided in Red Hat advisory RHSA-2026:47248 and reboot the system to activate the patch. Red Hat recommends treating this kernel update as security-relevant and applying it promptly. Patch status is confirmed as available via the vendor advisory.