Medium 5.5Published May 6, 2026

CVE-2026-43132dm-verity: correctly handle dm_bufio_client_create() failure

Updated under an hour ago (Oct 28, 2026, 4:40 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: dm-verity: correctly handle dm_bufio_client_create() failure If either of the calls to dm_bufio_client_create() in verity_fec_ctr() fails, then dm_bufio_client_destroy() is later called with an ERR_PTR() argument. That causes a crash. Fix this.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from a739ff3f543afbb4a041c16cd0182c8e8d366e70 before 6283e49af87a9c121bb01e5a64a7fe5706c210bc; from a739ff3f543afbb4a041c16cd0182c8e8d366e70 before d3e1f1adc8a0289efe2d2cdc90edb8c6ffe0b5ef; from a739ff3f543afbb4a041c16cd0182c8e8d366e70 before 5c2217ddb3b7e7ac25f4ebe9061258fc8f1c9167; from a739ff3f543afbb4a041c16cd0182c8e8d366e70 before 031f2adc1499b112a39ac316bbab3c80bba16cf2; from a739ff3f543afbb4a041c16cd0182c8e8d366e70 before 9b8dc1d327e2928f3da59ced0595d850d31c0936; from a739ff3f543afbb4a041c16cd0182c8e8d366e70 before 451cc650e40e8c3222d37877a9e4be0fcaacb9c8; from a739ff3f543afbb4a041c16cd0182c8e8d366e70 before b154a868a3856fb5216c4f82981d8a503832e095; from a739ff3f543afbb4a041c16cd0182c8e8d366e70 before 119f4f04186fa4f33ee6bd39af145cdaff1ff17f	CNA record
linux linux_kernel linux:linux_kernel	from 4.5 before 5.10.252; from 5.11 before 5.15.202; from 5.16 before 6.1.165; from 6.2 before 6.6.128; from 6.7 before 6.12.75; from 6.13 before 6.18.16; from 6.19 before 6.19.6	NVD

References

References

https://git.kernel.org/stable/c/6283e49af87a9c121bb01e5a64a7fe5706c210bc	patch
https://git.kernel.org/stable/c/d3e1f1adc8a0289efe2d2cdc90edb8c6ffe0b5ef	patch
https://git.kernel.org/stable/c/5c2217ddb3b7e7ac25f4ebe9061258fc8f1c9167	patch
https://git.kernel.org/stable/c/031f2adc1499b112a39ac316bbab3c80bba16cf2	patch
https://git.kernel.org/stable/c/9b8dc1d327e2928f3da59ced0595d850d31c0936	patch
https://git.kernel.org/stable/c/451cc650e40e8c3222d37877a9e4be0fcaacb9c8	patch
https://git.kernel.org/stable/c/b154a868a3856fb5216c4f82981d8a503832e095	patch
https://git.kernel.org/stable/c/119f4f04186fa4f33ee6bd39af145cdaff1ff17f	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.