Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
lvm2 may crash when reading crafted metadata
published 2 months ago
Summary
The lvm2 disk-management package can crash if it processes a specially crafted configuration file with very deep nesting. This can cause the system to stop LVM commands, leading to a denial of service. Apply the latest package update or avoid loading untrusted LVM metadata to prevent the issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | lvm2 | <= 2.03.23-1 |
Original advisory text
CVE-2026-19617 affecting package lvm2 2.03.23-1
A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the metadata to crash. This vulnerability results in a Denial of Service (DoS) for affected systems.
References
Timeline
Published14 Aug 2026
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-96698 · OSV
Track software like this
Free during beta