CVE-2026-72014 Linux CVE debrief

Who should care

System administrators and security teams managing Linux systems using DRBD (Distributed Replicated Block Device) for storage replication should be aware of this vulnerability. Nodes that read from their peer, especially in a default configuration without data-integrity-alg, are exposed to potential kernel memory corruption. Immediate patching is recommended to prevent potential exploitation.

Technical summary

The CVE-2026-72014 vulnerability exists in the drbd module of the Linux kernel. A malicious DRBD peer can supply a negative data size, leading to out-of-bounds memory access and potential kernel memory corruption. The issue arises from the recv_dless_read() function, which receives a P_DATA_REPLY from a peer into the bio of an outstanding read request. The peer-supplied payload length can become negative due to integer underflow or overflow, causing the bio receive loop to compute a negative expect value. This results in drbd_recv_all_warn() receiving with a size_t of SIZE_MAX into the first mapped page, allowing attacker-controlled data to be copied past the bio page.

Defensive priority

This vulnerability allows a malicious DRBD peer to corrupt kernel memory by copying attacker-chosen bytes past a bio page in the receiver. Nodes that read from their peer, especially in a default configuration without data-integrity-alg, are exposed. Immediate patching is recommended.

Recommended defensive actions

• Apply the patch from the Linux kernel repository to fix the vulnerability
• Restrict access to DRBD peers to only trusted nodes
• Monitor for suspicious activity on DRBD connections
• Consider enabling data-integrity-alg for enhanced security
• Perform vulnerability scanning to identify exposed systems
• Implement network segmentation to limit the attack surface
• Review system logs for indicators of compromise

Evidence notes

The Linux kernel vulnerability (CVE-2026-72014) exists in the drbd module, where a malicious peer can supply a negative data size, leading to out-of-bounds memory access. Official references from the Linux kernel Git repository confirm the fix for this issue. Evidence is based on official CVE and NVD records, as well as source references from the Linux kernel.

Official resources