---
id: CVE-2026-110036
title: A flaw was found in device-mapper-persistent-data
summary: >-
  A flaw was found in device-mapper-persistent-data. A local attacker can cause
  a Denial of Service (DoS) by inducing a user or system tool to process crafted
  device metadata containing an excessively large block index. An arithmetic
  error…
severity: low
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'
cwe:
  - CWE-190
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4
affected:
  - enterprise_linux 10
  - enterprise_linux 6
  - enterprise_linux 7
  - enterprise_linux 8
  - enterprise_linux 9
  - openshift_container_platform 4
published: '2026-10-13'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T16:17:37.803'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-110036'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-110036'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2474403'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2474403'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-110036.json
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-110036'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-110036'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - cve.org
  - exploit-available
ingestedAt: '2026-10-13T19:43:28.932Z'
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-14T15:29:09.572041Z'
epss: 0.00184
epssPercentile: 0.07932
---

## Overview

A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service (DoS) by inducing a user or system tool to process crafted device metadata containing an excessively large block index. An arithmetic error in the synchronous block reading logic causes the application to panic and unexpectedly terminate.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, … · updated 2026-10-13 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-110036.json)