---
id: CVE-2026-72316
title: 'dm era: fix NULL pointer dereference in metadata_open()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  dm era: fix NULL pointer dereference in metadata_open()

  metadata_open() returns NULL when kzalloc_obj() fails, but the
  caller era_ctr() only checks IS_ERR(md).  Since …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= eec40579d84873dfb7021eb24c50360f073237c5 <
    a705e056c2f3dd067fb2ff414f0537530baa090b
  - >-
    Linux >= eec40579d84873dfb7021eb24c50360f073237c5 <
    bd5a80128bdfc93b1cae935a70da000b8c483e6e
  - >-
    Linux >= eec40579d84873dfb7021eb24c50360f073237c5 <
    17eb2ab13edd0b06ce6f996c5fd450d7efabb2e8
  - >-
    Linux >= eec40579d84873dfb7021eb24c50360f073237c5 <
    889374b8e4a60d13fe4a5a8ae3a311ca93d1a2c3
  - >-
    Linux >= eec40579d84873dfb7021eb24c50360f073237c5 <
    01c49eae7c6256f2d8cc08210a2bac3ee070e43a
  - >-
    Linux >= eec40579d84873dfb7021eb24c50360f073237c5 <
    14e03ecd3b1b5fc03c082b27a2f8889f8290c30e
  - >-
    Linux >= eec40579d84873dfb7021eb24c50360f073237c5 <
    b69ea153d30ce19ca8997eeeca1e2219fae5a29b
  - >-
    Linux >= eec40579d84873dfb7021eb24c50360f073237c5 <
    9ae672606c17891d90b282e3490b817620549599
  - Linux 3.15
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:54:38.013413Z'
published: '2026-08-15'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:55:25.833Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72316'
references:
  - url: 'https://git.kernel.org/stable/c/a705e056c2f3dd067fb2ff414f0537530baa090b'
  - url: 'https://git.kernel.org/stable/c/bd5a80128bdfc93b1cae935a70da000b8c483e6e'
  - url: 'https://git.kernel.org/stable/c/17eb2ab13edd0b06ce6f996c5fd450d7efabb2e8'
  - url: 'https://git.kernel.org/stable/c/889374b8e4a60d13fe4a5a8ae3a311ca93d1a2c3'
  - url: 'https://git.kernel.org/stable/c/01c49eae7c6256f2d8cc08210a2bac3ee070e43a'
  - url: 'https://git.kernel.org/stable/c/14e03ecd3b1b5fc03c082b27a2f8889f8290c30e'
  - url: 'https://git.kernel.org/stable/c/b69ea153d30ce19ca8997eeeca1e2219fae5a29b'
  - url: 'https://git.kernel.org/stable/c/9ae672606c17891d90b282e3490b817620549599'
tags:
  - cve.org
epss: 0.0022
epssPercentile: 0.12545
ingestedAt: '2026-11-06T18:00:12.581Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

dm era: fix NULL pointer dereference in metadata_open()

metadata_open() returns NULL when kzalloc_obj() fails, but the
caller era_ctr() only checks IS_ERR(md).  Since IS_ERR(NULL)
returns false, the NULL pointer is treated as a valid result
and later assigned to era->md, leading to a NULL pointer
dereference when the metadata is accessed.

Fix this by returning ERR_PTR(-ENOMEM) on allocation failure,
consistent with dm-cache-metadata.c, dm-thin-metadata.c, and
dm-clone-metadata.c which all use ERR_PTR(-ENOMEM) for the
same pattern.

## Affected

- `Linux >= eec40579d84873dfb7021eb24c50360f073237c5 < a705e056c2f3dd067fb2ff414f0537530baa090b`
- `Linux >= eec40579d84873dfb7021eb24c50360f073237c5 < bd5a80128bdfc93b1cae935a70da000b8c483e6e`
- `Linux >= eec40579d84873dfb7021eb24c50360f073237c5 < 17eb2ab13edd0b06ce6f996c5fd450d7efabb2e8`
- `Linux >= eec40579d84873dfb7021eb24c50360f073237c5 < 889374b8e4a60d13fe4a5a8ae3a311ca93d1a2c3`
- `Linux >= eec40579d84873dfb7021eb24c50360f073237c5 < 01c49eae7c6256f2d8cc08210a2bac3ee070e43a`
- `Linux >= eec40579d84873dfb7021eb24c50360f073237c5 < 14e03ecd3b1b5fc03c082b27a2f8889f8290c30e`
- `Linux >= eec40579d84873dfb7021eb24c50360f073237c5 < b69ea153d30ce19ca8997eeeca1e2219fae5a29b`
- `Linux >= eec40579d84873dfb7021eb24c50360f073237c5 < 9ae672606c17891d90b282e3490b817620549599`
- `Linux 3.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.