CVE-2026-72316 dm era: fix NULL pointer dereference in metadata_open()
A local attacker with high privileges can trigger a NULL pointer dereference in the Linux kernel dm era driver, causing a system crash.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72316?
CVE-2026-72316 is a vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
dm era: fix NULL pointer dereference in metadata_open()
metadata_open() returns NULL when kzalloc_obj() fails, but the caller era_ctr() only checks IS_ERR(md). Since IS_ERR(NULL) returns false, the NULL pointer is treated as a valid result and later assigned to era->md, leading to a NULL pointer dereference when the metadata is accessed.
Fix this by returning ERR_PTR(-ENOMEM) on allocation failure, consistent with dm-cache-metadata.c, dm-thin-metadata.c, and dm-clone-metadata.c which all use ERR_PTR(-ENOMEM) for the same pattern.
Which versions are affected by CVE-2026-72316?
How do I fix CVE-2026-72316?
Apply the vendor's patch.
Is CVE-2026-72316 being exploited?
There is no known exploitation of CVE-2026-72316 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72316, DEBIAN-CVE-2026-72316, GHSA-r48m-h265-23mg, UBUNTU-CVE-2026-72316.