CVE-2026-19617: 
Vim Analyse et atténuation des vulnérabilités

CVE-2026-19617 is a Denial of Service vulnerability in libdm (the device-mapper library used by LVM2) caused by uncontrolled recursion in its configuration file parser. A local attacker can craft a malicious LVM metadata configuration with deeply nested structures, causing any LVM command that reads the metadata to crash due to stack exhaustion. The vulnerability was reported on August 12, 2026, and published to the NVD on August 14, 2026. Affected products include the lvm2 package across Red Hat Enterprise Linux 6 through 10 and Red Hat OpenShift Container Platform 4 (via rhcos). It carries a CVSS v3.1 base score of 5.5 (Medium), as assigned by Red Hat (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). Specifically, the libdm configuration file parser in libdm-config.c implements recursive descent parsing with no depth limit, meaning deeply nested configuration structures will cause unbounded recursion until the call stack is exhausted (Red Hat Bugzilla). The attack vector is local: an attacker must be able to create or modify LVM metadata on a block device or supply a crafted metadata file that a privileged LVM command subsequently reads. User interaction is required (e.g., an administrator running an LVM command against attacker-controlled metadata), and no privileges are required of the attacker themselves (Red Hat CVE). No public proof-of-concept exploit code has been identified at this time.

Successful exploitation results in a crash of any LVM command (e.g., pvs, vgs, lvs, vgimport) that processes the malicious metadata, causing a Denial of Service. There is no impact on confidentiality or integrity — the vulnerability is purely an availability issue. Systems most at risk are those where untrusted users have write access to LVM metadata or where LVM physical volumes are imported from shared or externally-attached storage without prior inspection (Red Hat CVE).

No public exploit code or in-the-wild exploitation has been reported for CVE-2026-19617. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and the ability to influence LVM metadata that a privileged process will read, limiting the practical attack surface.

1. Gain local access: Obtain a local account on a target system running a vulnerable version of lvm2, or gain the ability to write to a block device or LVM metadata store accessible by the target system.
2. Craft malicious LVM metadata: Create a specially crafted LVM metadata configuration file (e.g., within a physical volume label or a lvm.conf-style file) containing deeply nested configuration structures — for example, hundreds of levels of nested sections or key-value groups — that will trigger unbounded recursion in libdm-config.c.
3. Place the metadata: Write the malicious metadata to a physical volume, a shared storage device, or a location where it will be read by an LVM command (e.g., attach a crafted disk image or modify metadata on a shared block device).
4. Trigger LVM command execution: Wait for or induce an administrator or automated process to run an LVM command (e.g., pvs, vgimport, vgscan) that reads the malicious metadata.
5. Achieve DoS: The recursive descent parser in libdm-config.c processes the nested structures without a depth limit, exhausting the stack and causing the LVM command to crash, disrupting storage management operations (Red Hat Bugzilla, Red Hat CVE).

• Logs: Kernel or system logs (e.g., /var/log/messages, journalctl) showing segmentation faults or stack overflow signals (SIGSEGV, SIGABRT) from LVM-related processes such as lvm, pvs, vgs, lvs, or vgimport.
• Process: Unexpected crashes of LVM commands, particularly when scanning or importing physical volumes from external or shared storage.
• File System: Presence of unusual or externally-sourced block devices or disk images with LVM metadata containing abnormally deep nesting (detectable by inspecting raw metadata with tools like pvck --dump metadata).
• System: Repeated lvm command failures or core dumps in /var/crash or /tmp associated with libdm stack exhaustion.

Red Hat has acknowledged the vulnerability and a patch is in progress (tracked in Bugzilla bug 2514626). Until a fixed package is released, Red Hat recommends avoiding the import of LVM physical volumes from untrusted sources without first inspecting the metadata (Red Hat CVE). Systems using LVM on shared or externally-attached storage should ensure that only trusted administrators have write access to the underlying block devices. Monitor the Red Hat Customer Portal and errata for updated lvm2 packages for RHEL 6–10 and RHCOS.

Red Hat credited Tristan Madani for discovering and reporting this vulnerability (Red Hat CVE). The CVE was classified as Moderate impact by Red Hat, reflecting its limited scope to systems where untrusted users can influence LVM metadata. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified at this time.