# CVE-2026-72014: drbd: reject data replies with an out-of-range payload size

> A malicious DRBD peer can trigger an integer overflow to corrupt kernel memory, potentially leading to code execution or privilege escalation.

- **Severity:** Critical 9.8 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 15 Aug 2026
- **Updated:** 19 Oct 2026
- **Also known as:** BELL-CVE-2026-72014, DEBIAN-CVE-2026-72014, GHSA-3m7c-3jm4-qc8p, UBUNTU-CVE-2026-72014

## What is CVE-2026-72014?

CVE-2026-72014 is a critical vulnerability in Linux, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

drbd: reject data replies with an out-of-range payload size

recv_dless_read() receives a P_DATA_REPLY from a peer into the bio of an
outstanding read request. The peer-supplied payload length reaches it as
the signed int data_size, and two peer-controlled inputs can make it
negative. With a negotiated data-integrity-alg the digest length is
subtracted first, so a reply whose payload is smaller than the digest
underflows data_size. With no integrity algorithm (the default) data_size
is assigned from the unsigned h95/h100 wire length and drbdd() never
bounds it for a payload-carrying command, so a length above INT_MAX casts
it negative; this path needs no non-default feature. The bio receive loop
then computes expect = min_t(int, data_size, bv_len), which is negative,
and drbd_recv_all_warn(mapped, expect) receives with a size_t of SIZE_MAX
into the first mapped page.

The sibling receive path read_in_block() is not affected: it uses an
unsigned size and rejects it against DRBD_MAX_BIO_SIZE before receiving.
Reject a data reply whose size is negative after the optional digest
subtraction, covering both triggers.

Impact: a malicious or man-in-the-middle DRBD peer copies attacker-chosen
bytes past a bio page in the receiver, corrupting kernel memory. A node
that reads from its peer (a diskless node, or read-balancing to the peer)
is exposed in the default configuration; data-integrity-alg is not
required.

Weakness: CWE-190 (Integer Overflow or Wraparound)

## Which versions are affected by CVE-2026-72014?


## How do I fix CVE-2026-72014?

Apply the vendor's patch.

## Is CVE-2026-72014 being exploited?

There is no known exploitation of CVE-2026-72014 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-72014 and fix it if it is affected.

What it is: CVE-2026-72014 is a critical vulnerability in Linux, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-72014 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-72014/ (Markdown: https://insights.sbomify.com/CVE-2026-72014/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-72014
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-72014
- OSV: https://osv.dev/vulnerability/CVE-2026-72014

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-72014/
Summaries are generated and may contain mistakes; the official description above is the record.