Look up another CVE · open CVE-2026-72014 in the interactive tracker
CVE-2026-72014
drbd: reject data replies with an out-of-range payload size
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem drivers/block. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-72014 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixed | 6.1.180-1 | Update the kernel and reboot. Fixed in 6.1.180-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.100-1 | Update the kernel and reboot. Fixed in 6.12.100-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
recv_dless_read() receives a P_DATA_REPLY from a peer into the bio of an outstanding read request. The peer-supplied payload length reaches it as the signed int data_size, and two peer-controlled inputs can make it negative. With a negotiated data-integrity-alg the digest length is subtracted first, so a reply whose payload is smaller than the digest underflows data_size. With no integrity algorithm (the default) data_size is assigned from the unsigned h95/h100 wire length and drbdd() never bounds it for a payload-carrying command, so a length above INT_MAX casts it negative; this path needs no non-default feature. The bio receive loop then computes expect = min_t(int, data_size, bv_len), which is negative, and drbd_recv_all_warn(mapped, expect) receives with a size_t of SIZE_MAX into the first mapped page. The sibling receive path read_in_block() is not affected: it uses an unsigned size and rejects it against DRBD_MAX_BIO_SIZE before receiving. Reject a data reply whose size is negative after the optional digest subtraction, covering both triggers. Impact: a malicious or man-in-the-middle DRBD peer copies attacker-chosen bytes past a bio page in the receiver, corrupting kernel memory. A node that reads from its peer (a diskless node, or read-balancing to the peer) is exposed in the default configuration; data-integrity-alg is not required.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/block/drbd/drbd_receiver.c
- What this is
- DRBD DRIVERMAINTAINERS section matched on drivers/block/drbd/ · drbd-dev@lists.linux.dev · Supported
- Kernel module
- drbd
Check it on the machine
grep -w CONFIG_BLK_DEV_DRBD /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w drbdPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sidm
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switch
- CONFIG_BLK_DEV_DRBD
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.72%, higher than 53.1% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/block
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 2.6.33 | 5.10.261 | bca33f5442c3 |
| 2.6.33 | 5.15.212 | 741a682535de |
| 2.6.33 | 6.1.178 | f14e87d7b166 |
| 2.6.33 | 6.6.145 | f16866c62656 |
| 2.6.33 | 6.12.97 | 5f59a8142000 |
| 2.6.33 | 6.18.40 | 38cc4867540a |
| 2.6.33 | 7.1.5 | 648d4317326e |
| 2.6.33 | 7.2 | bd910a7660d2 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- Exploitation is delivered over the DRBD replication TCP protocol when a victim node receives a malicious P_DATA_REPLY from its peer or a man-in-the-middle on that link; recv_dless_read() is reached from drbdd() without any local syscall or ioctl on the victim.
- AC:LAttack complexity, low
- The peer fully controls the wire length in the P_DATA_REPLY header, and two independent triggers (unsigned-to-signed overflow or digest subtraction underflow) deterministically force expect negative so drbd_recv_all_warn() receives SIZE_MAX bytes whenever the victim issues a remote read.
- PR:NPrivileges required, none
- No account, capability, or administrative access on the victim host is required; a malicious DRBD peer or network man-in-the-middle on the replication link can send the crafted reply after connection setup, and cram-hmac-alg peer authentication is optional.
- UI:NUser interaction, none
- No end-user action is needed because diskless-primary and read-balancing configurations automatically send P_DATA_REQUEST packets to the peer, and the malicious P_DATA_REPLY is processed in the kernel receiver thread during normal I/O.
- S:UScope, unchanged
- The out-of-bounds socket receive corrupts kernel memory on the same host that runs DRBD; successful exploitation yields kernel compromise on that node but does not by itself cross a VM, container, or IOMMU security boundary.
- C:HConfidentiality impact, high
- Receiving up to SIZE_MAX attacker-controlled bytes past the mapped bio page is an out-of-bounds kernel write that can corrupt adjacent heap or page data and be leveraged for arbitrary kernel memory disclosure, not merely a bounded leak.
- I:HIntegrity impact, high
- The bug copies attacker-chosen network data beyond the allocated bio buffer boundary, providing a kernel out-of-bounds write primitive that can corrupt kernel structures and enable arbitrary code execution or privilege escalation.
- A:HAvailability impact, high
- Writing gigabytes past a bio page can immediately corrupt critical kernel memory and cause oops or panic, and repeated malicious replies can keep the node unavailable even before full exploitation.