In the Linux kernel, the following vulnerability has been resolved: dm log: fix out-of-bounds write due to region_count overflow The local variable… (CVE-2026-53059)
In the Linux kernel, the following vulnerability has been resolved: dm log: fix out-of-bounds write due to region_count overflow The local variable region_count in create_log_context() is declared as unsigned int (32-bit), but dm_sector_div_up() returns sector_t (64-bit). When a device-mapper target has a sufficiently large ti->len with a small region_size, the division result can exceed UINT_MAX. The truncated value is then used to calculate bitset_size, causing clean_bits, sync_bits, and recovering_bits to be allocated far smaller than needed for the actual number of regions. Subsequent log operations (log_set_bit, log_clear_bit, log_test_bit) use region indices derived from the full untruncated region space, causing out-of-bounds writes to kernel heap memory allocated by vmalloc. This can be reproduced by creating a mirror target whose region_count overflows 32 bits: dmsetup create bigzero --table '0 8589934594 zero' dmsetup create mymirror --table '0 8589934594 mirror \ core 2 2 nosync 2 /dev/mapper/bigzero 0 \ /dev/mapper/bigzero 0' The status output confirms the truncation (sync_count=1 instead of 4294967297, because 0x100000001 was truncated to 1): $ dmsetup status mymirror 0 8589934594 mirror 2 254:1 254:1 1/4294967297 ... This leads to a kernel crash in core_in_sync: BUG: scheduling while atomic: (udev-worker)/9150/0x00000000 RIP: 0010:core_in_sync+0x14/0x30 [dm_log] CR2: 0000000000000008 Fixing recursive fault but reboot is needed! Fix by widening the local region_count to sector_t and adding an explicit overflow check before the value is assigned to lc->region_count.
AI Analysis
Technical Summary
The Linux kernel's device-mapper log component contained an integer overflow vulnerability (CVE-2026-53059) due to the truncation of a 64-bit sector_t value to a 32-bit unsigned int variable region_count. When a device-mapper target has a large length with a small region size, the division result can exceed UINT_MAX, causing memory allocations for bitsets to be smaller than required. Subsequent log operations use region indices based on the full untruncated region space, resulting in out-of-bounds writes to kernel heap memory allocated by vmalloc. This flaw can be triggered locally by creating a mirror target with a region_count overflow. The vulnerability has a CVSS v3.1 score of 7.0 (high severity) and can cause denial of service via kernel crash.
Potential Impact
Successful exploitation of this vulnerability can cause out-of-bounds writes in kernel memory, leading to a kernel crash and denial of service (DoS) on the affected system. The flaw does not have confirmed remote exploitability and requires local access with low privileges. There is no evidence of known exploits in the wild at this time.
Mitigation Recommendations
An official fix is available and has been released by Red Hat in kernel updates for affected products including Red Hat Enterprise Linux 8.4 variants. Users should apply the security update (e.g., RHSA-2026:47248) and reboot systems to ensure the patch takes effect. Red Hat recommends treating all kernel errata as security-relevant and applying updates promptly to mitigate exposure. No additional mitigations are specified beyond applying the vendor-provided patch.
In the Linux kernel, the following vulnerability has been resolved: dm log: fix out-of-bounds write due to region_count overflow The local variable… (CVE-2026-53059)
Description
In the Linux kernel, the following vulnerability has been resolved: dm log: fix out-of-bounds write due to region_count overflow The local variable region_count in create_log_context() is declared as unsigned int (32-bit), but dm_sector_div_up() returns sector_t (64-bit). When a device-mapper target has a sufficiently large ti->len with a small region_size, the division result can exceed UINT_MAX. The truncated value is then used to calculate bitset_size, causing clean_bits, sync_bits, and recovering_bits to be allocated far smaller than needed for the actual number of regions. Subsequent log operations (log_set_bit, log_clear_bit, log_test_bit) use region indices derived from the full untruncated region space, causing out-of-bounds writes to kernel heap memory allocated by vmalloc. This can be reproduced by creating a mirror target whose region_count overflows 32 bits: dmsetup create bigzero --table '0 8589934594 zero' dmsetup create mymirror --table '0 8589934594 mirror \ core 2 2 nosync 2 /dev/mapper/bigzero 0 \ /dev/mapper/bigzero 0' The status output confirms the truncation (sync_count=1 instead of 4294967297, because 0x100000001 was truncated to 1): $ dmsetup status mymirror 0 8589934594 mirror 2 254:1 254:1 1/4294967297 ... This leads to a kernel crash in core_in_sync: BUG: scheduling while atomic: (udev-worker)/9150/0x00000000 RIP: 0010:core_in_sync+0x14/0x30 [dm_log] CR2: 0000000000000008 Fixing recursive fault but reboot is needed! Fix by widening the local region_count to sector_t and adding an explicit overflow check before the value is assigned to lc->region_count.
CVSS v3.1
Score 7.0high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's device-mapper log component contained an integer overflow vulnerability (CVE-2026-53059) due to the truncation of a 64-bit sector_t value to a 32-bit unsigned int variable region_count. When a device-mapper target has a large length with a small region size, the division result can exceed UINT_MAX, causing memory allocations for bitsets to be smaller than required. Subsequent log operations use region indices based on the full untruncated region space, resulting in out-of-bounds writes to kernel heap memory allocated by vmalloc. This flaw can be triggered locally by creating a mirror target with a region_count overflow. The vulnerability has a CVSS v3.1 score of 7.0 (high severity) and can cause denial of service via kernel crash.
Potential Impact
Successful exploitation of this vulnerability can cause out-of-bounds writes in kernel memory, leading to a kernel crash and denial of service (DoS) on the affected system. The flaw does not have confirmed remote exploitability and requires local access with low privileges. There is no evidence of known exploits in the wild at this time.
Mitigation Recommendations
An official fix is available and has been released by Red Hat in kernel updates for affected products including Red Hat Enterprise Linux 8.4 variants. Users should apply the security update (e.g., RHSA-2026:47248) and reboot systems to ensure the patch takes effect. Red Hat recommends treating all kernel errata as security-relevant and applying updates promptly to mitigate exposure. No additional mitigations are specified beyond applying the vendor-provided patch.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-vj88-ppr4-hj46
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-53059"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a6ae5599c2644c7f89a91f3
Added to database: 07/30/2026, 05:47:05 UTC
Last enriched: 08/12/2026, 18:01:01 UTC
Last updated: 09/11/2026, 07:31:54 UTC
Views: 48
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.