CVE-2026-19617
Public on 2026-08-14
Modified on 2026-08-15
Description
A flaw was found in libdm. A remote attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the metadata to crash. This vulnerability results in a Denial of Service (DoS) for affected systems.
Severity
See what this means
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 2 - Core | lvm2 | 2026-11-09 | ALAS2-2026-4073 | Fixed |
| Amazon Linux 2023 | lvm2 | 2026-11-09 | ALAS2023-2026-3376 | Fixed |
| Amazon Linux 2027 Preview | lvm2 | 2026-11-02 | ALAS2027-2026-299 | Fixed |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |