---
id: CVE-2026-72106
title: 'dm-ioctl: fix a possible overflow in list_version_get_info'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  dm-ioctl: fix a possible overflow in list_version_get_info

  sizeof(tt->version) is 12 bytes, but the code writes 16 bytes into the
  output buffer - info->vers->version[0…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    3cba74d3fb2c1890ffae019301227d1366f74907
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    29536a9ff146d9bbd618959857ed2e691cda1d21
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    e0f5842c4e2a7dbefb52a2dc6711789bc6963e55
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    d61c12573ed9768690fdcb2bc38846a1bcb01358
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    df50c24c6447c18886ed126d3d81cc7e155ea8b6
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    76c6f845dc0c614304a6e6ee619b552f97cf24b3
  - Linux 2.6.12
published: '2026-08-15'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:28:48.016Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72106'
references:
  - url: 'https://git.kernel.org/stable/c/3cba74d3fb2c1890ffae019301227d1366f74907'
  - url: 'https://git.kernel.org/stable/c/29536a9ff146d9bbd618959857ed2e691cda1d21'
  - url: 'https://git.kernel.org/stable/c/e0f5842c4e2a7dbefb52a2dc6711789bc6963e55'
  - url: 'https://git.kernel.org/stable/c/d61c12573ed9768690fdcb2bc38846a1bcb01358'
  - url: 'https://git.kernel.org/stable/c/df50c24c6447c18886ed126d3d81cc7e155ea8b6'
  - url: 'https://git.kernel.org/stable/c/76c6f845dc0c614304a6e6ee619b552f97cf24b3'
tags:
  - cve.org
epss: 0.00229
epssPercentile: 0.13716
ingestedAt: '2026-11-05T15:02:32.477Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

dm-ioctl: fix a possible overflow in list_version_get_info

sizeof(tt->version) is 12 bytes, but the code writes 16 bytes into the
output buffer - info->vers->version[0], info->vers->version[1],
info->vers->version[2] and info->vers->next. This can cause buffer
overflow.

Fix this buffer overflow by replacing "sizeof(tt->version)" with
"sizeof(struct dm_target_versions)".

## Affected

- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 3cba74d3fb2c1890ffae019301227d1366f74907`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 29536a9ff146d9bbd618959857ed2e691cda1d21`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < e0f5842c4e2a7dbefb52a2dc6711789bc6963e55`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < d61c12573ed9768690fdcb2bc38846a1bcb01358`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < df50c24c6447c18886ed126d3d81cc7e155ea8b6`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 76c6f845dc0c614304a6e6ee619b552f97cf24b3`
- `Linux 2.6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.