CVE-2026-43125: Linux Kernel buffer overflow in dlm_search_rsb_tree

CVE-2026-43125 · Severity: critical · CVSS 9.8 · Published 2026-05-06

A vulnerability exists in the Linux kernel's Distributed Lock Manager (DLM), a component used to coordinate resources in clustered environments. An attacker can send a specially crafted network message that triggers a memory error, potentially allowing them to crash the system or execute unauthorized commands. This could lead to a complete loss of system availability and the exposure of sensitive data across the cluster.

Technologies: Linux Kernel, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9. Vendors: Linux, Red Hat.

Quick answers

Is CVE-2026-43125 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-43125 being exploited in the wild.
How severe is CVE-2026-43125?
Critical severity, with a CVSS score of 9.8, published 6 May 2026.
Which products and versions are affected?
Linux Kernel 7210cb7a72a22303cdb225bd1aea28697a17bbae to 67288113c5e6cf9e659b4065c0ed6f16100e0c71.
Is there a fix for CVE-2026-43125?
A patch was published on 2026-06-10: Red Hat security advisory issued Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-43125 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2026-43125?
Check whether you run Linux Kernel, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is classified as an out-of-bounds write (CWE-787) and improper handling of length parameter (CWE-130) within the Linux kernel's Distributed Lock Manager (DLM) subsystem. The root cause is located in the `dlm_search_rsb_tree()` function in `fs/dlm/lock.c`, where a `len` parameter derived from unvalidated network messages is used in a `memcpy()` operation into a fixed-size buffer (`key[DLM_RESNAME_MAXLEN]`). If the provided length exceeds `DLM_RESNAME_MAXLEN`, a stack-based buffer overflow occurs. The attack vector is over the network, requiring no prior authentication or user interaction. Successful exploitation can result in a kernel panic (DoS) or arbitrary code execution with kernel privileges. Patches have been released for various stable kernel branches and Red Hat Enterprise Linux versions.

Affected products

  • Linux Linux Kernel 7210cb7a72a22303cdb225bd1aea28697a17bbae to 67288113c5e6cf9e659b4065c0ed6f16100e0c71
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9

Timeline

  • 2026-01-20: other: Initial patch authored
  • 2026-05-06: advisory: CVE published
  • 2026-06-10: patched: Red Hat security advisory issued

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.