CVE-2026-72014

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

drbd: reject data replies with an out-of-range payload size

recv_dless_read() receives a P_DATA_REPLY from a peer into the bio of an

outstanding read request. The peer-supplied payload length reaches it as

the signed int data_size, and two peer-controlled inputs can make it

negative. With a negotiated data-integrity-alg the digest length is

subtracted first, so a reply whose payload is smaller than the digest

underflows data_size. With no integrity algorithm (the default) data_size

is assigned from the unsigned h95/h100 wire length and drbdd() never

bounds it for a payload-carrying command, so a length above INT_MAX casts

it negative; this path needs no non-default feature. The bio receive loop

then computes expect = min_t(int, data_size, bv_len), which is negative,

and drbd_recv_all_warn(mapped, expect) receives with a size_t of SIZE_MAX

into the first mapped page.

The sibling receive path read_in_block() is not af

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References