# CVE-2026-43125: Linux Kernel buffer overflow in dlm_search_rsb_tree

Source: https://junglewise.ai/threats/cve-2026-43125-linux-kernel-buffer-overflow-in-dlm-search-rsb-tree  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-06. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-43125 · Severity: critical · CVSS 9.8 · Published 2026-05-06

A vulnerability exists in the Linux kernel's Distributed Lock Manager (DLM), a component used to coordinate resources in clustered environments. An attacker can send a specially crafted network message that triggers a memory error, potentially allowing them to crash the system or execute unauthorized commands. This could lead to a complete loss of system availability and the exposure of sensitive data across the cluster.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel), [Red Hat Enterprise Linux 7](https://junglewise.ai/threats/technologies/enterprise-linux-7), [Red Hat Enterprise Linux 8](https://junglewise.ai/threats/technologies/enterprise-linux-8), [Red Hat Enterprise Linux 9](https://junglewise.ai/threats/technologies/enterprise-linux-9). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-43125 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43125 being exploited in the wild.

**How severe is CVE-2026-43125?** Critical severity, with a CVSS score of 9.8, published 6 May 2026.

**Which products and versions are affected?** Linux Kernel 7210cb7a72a22303cdb225bd1aea28697a17bbae to 67288113c5e6cf9e659b4065c0ed6f16100e0c71.

**Is there a fix for CVE-2026-43125?** A patch was published on 2026-06-10: Red Hat security advisory issued Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-43125 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-43125?** Check whether you run Linux Kernel, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is classified as an out-of-bounds write (CWE-787) and improper handling of length parameter (CWE-130) within the Linux kernel's Distributed Lock Manager (DLM) subsystem. The root cause is located in the `dlm_search_rsb_tree()` function in `fs/dlm/lock.c`, where a `len` parameter derived from unvalidated network messages is used in a `memcpy()` operation into a fixed-size buffer (`key[DLM_RESNAME_MAXLEN]`). If the provided length exceeds `DLM_RESNAME_MAXLEN`, a stack-based buffer overflow occurs. The attack vector is over the network, requiring no prior authentication or user interaction. Successful exploitation can result in a kernel panic (DoS) or arbitrary code execution with kernel privileges. Patches have been released for various stable kernel branches and Red Hat Enterprise Linux versions.

## Affected products

- Linux Linux Kernel 7210cb7a72a22303cdb225bd1aea28697a17bbae to 67288113c5e6cf9e659b4065c0ed6f16100e0c71
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9

## Timeline

- 2026-01-20: other: Initial patch authored
- 2026-05-06: advisory: CVE published
- 2026-06-10: patched: Red Hat security advisory issued

## References

- [https://git.kernel.org/stable/c/080e5563f878c64e697b89e7439d730d0daad882](https://git.kernel.org/stable/c/080e5563f878c64e697b89e7439d730d0daad882)
- [https://git.kernel.org/stable/c/082083c9fbd99422a0370fe2102144a231c9f5d6](https://git.kernel.org/stable/c/082083c9fbd99422a0370fe2102144a231c9f5d6)
- [https://git.kernel.org/stable/c/5f053a2e7209d326cbbc07738fa6d6893d307438](https://git.kernel.org/stable/c/5f053a2e7209d326cbbc07738fa6d6893d307438)
- [https://git.kernel.org/stable/c/67288113c5e6cf9e659b4065c0ed6f16100e0c71](https://git.kernel.org/stable/c/67288113c5e6cf9e659b4065c0ed6f16100e0c71)
- [https://access.redhat.com/errata/RHSA-2026:25120](https://access.redhat.com/errata/RHSA-2026:25120)
- [https://access.redhat.com/errata/RHSA-2026:25121](https://access.redhat.com/errata/RHSA-2026:25121)
- [https://access.redhat.com/errata/RHSA-2026:25217](https://access.redhat.com/errata/RHSA-2026:25217)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel shared-frag flag loss in skb_zerocopy](https://junglewise.ai/threats/cve-2026-99284-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel netfilter conntrack TCP RST timeout handling](https://junglewise.ai/threats/cve-2026-99283-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)