CVE-2026-72014

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the DRBD module where the recv dless read() function fails to properly validate the payload size of a P DATA REPLY received from a peer. The payload length is handled as a signed integer data size, which can become negative under two conditions: when a payload is smaller than the negotiated digest length in data-integrity-alg, or when the wire length exceeds INT MAX in the default configuration. This leads to a negative value being passed to drbd recv all warn(), which interprets the size as SIZE MAX, allowing a malicious or man-in-the-middle peer to copy arbitrary bytes beyond a bio page and corrupt kernel memory. This affects diskless nodes or nodes using read-balancing in the default configuration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.