---

01 — Overview

CVE-2026-72018 is a Linux kernel out-of-bounds write vulnerability affecting the DIBS/ISM loopback functionality.

The vulnerability is associated with the handling of data transferred into a registered DMB (Data Memory Buffer).

The affected implementation does not adequately validate the relationship between the supplied offset, transfer size, and the actual DMB boundaries before performing the memory operation.

Vulnerability Classification

Property	Value
CVE	CVE-2026-72018
CWE	CWE-787 — Out-of-bounds Write
CVSS v3.1	7.8 — High
Attack Vector	Local
Privileges Required	Low
User Interaction	None
Confidentiality	High
Integrity	High
Availability	High
Component	Linux Kernel
Area	DIBS / ISM Loopback

---

02 — Technical Summary

The vulnerable code path involves:

drivers/dibs/dibs_loopback.c

and the:

move_data()

function.

Conceptually, the problematic operation can be represented as:

memcpy(destination + offset, source, size);

The security boundary that must be maintained is:

offset + size <= DMB_length

If this relationship is not correctly enforced, the resulting memory operation may extend beyond the valid DMB region.

             DMB
┌──────────────────────────────────────┐
│                                      │
│        Valid Memory Region           │
│                                      │
│   ┌────────────────────────────┐     │
│   │      offset + size         │     │
│   └────────────────────────────┘     │
│                                      │
└──────────────────────────────────────┘
                    │
                    ▼
              Boundary Check
                    │
          ┌─────────┴─────────┐
          │                   │
        VALID               INVALID
          │                   │
          ▼                   ▼
       memcpy()        Out-of-Bounds Write

---

03 — Root Cause

The underlying issue is insufficient bounds validation before copying data into the destination DMB.

A secure implementation should ensure that:

offset <= dmb_length

and:

size <= dmb_length - offset

before performing the copy.

Using subtraction for the second check also avoids an integer-overflow-style comparison such as:

offset + size <= dmb_length

when dealing with attacker-controlled integer values.

Secure Validation Concept

if (offset > dmb_length)
    return -EINVAL;

if (size > dmb_length - offset)
    return -EINVAL;

Only after these checks should the memory operation proceed.

---

04 — Security Impact

An out-of-bounds write in kernel space can potentially result in:

User-controlled input
        │
        ▼
Insufficient bounds validation
        │
        ▼
Out-of-bounds memory write
        │
        ├──► Kernel memory corruption
        │
        ├──► Kernel crash / DoS
        │
        └──► Potential privilege escalation

The actual exploitability and impact depend on the kernel configuration, memory layout, reachable code paths, mitigations, and system configuration.

Important: CVSS describes the potential severity of the vulnerability; it does not by itself demonstrate a working privilege-escalation or code-execution exploit.

---

05 — Affected Code

drivers/
└── dibs/
    └── dibs_loopback.c

Relevant function:

move_data()

The vulnerability involves the interaction between:

DIBS
 │
 └── ISM Loopback
       │
       └── DMB
            │
            └── Memory Transfer

---

06 — Affected Versions

Always verify the status against the kernel distribution you are testing because Linux distributions may backport security fixes.

Reported affected ranges include:

6.10.x

6.13.x – 6.18.39

6.19.x – 7.1.4

Reported fixed versions include:

6.12.97
6.18.40
7.1.5

Development branches may contain the fix at different revision points.

Check Your Kernel

uname -r

Additional information:

uname -a

For distribution-specific package information:

cat /etc/os-release

---

07 — Lab Verification

This repository is intended for authorized security research and defensive testing.

Recommended workflow:

# Identify the running kernel
uname -r

# Identify distribution
cat /etc/os-release

# Inspect kernel configuration
zgrep -i "DIBS\|ISM" /proc/config.gz 2>/dev/null

# Check loaded modules
lsmod | grep -Ei "dibs|ism"

# Inspect kernel messages
dmesg | grep -Ei "dibs|ism|smc"

For source-code analysis:

grep -R "move_data" drivers/dibs/ 2>/dev/null

The exact commands available depend on the kernel source and distribution configuration.

---

08 — Research Methodology

A useful analysis workflow is:

       ┌──────────────────┐
       │ Identify Kernel  │
       └────────┬─────────┘
                │
                ▼
       ┌──────────────────┐
       │ Locate Component │
       └────────┬─────────┘
                │
                ▼
       ┌──────────────────┐
       │ Review Data Flow │
       └────────┬─────────┘
                │
                ▼
       ┌──────────────────┐
       │ Find Boundary    │
       │ Validation       │
       └────────┬─────────┘
                │
                ▼
       ┌──────────────────┐
       │ Compare Patched  │
       │ / Vulnerable     │
       │ Implementations  │
       └────────┬─────────┘
                │
                ▼
       ┌──────────────────┐
       │ Validate in an   │
       │ Isolated Lab     │
       └──────────────────┘

---

09 — Defensive Analysis

When investigating a potentially affected system:

1. Identify the kernel

uname -r

2. Determine distribution

cat /etc/os-release

3. Check vendor security advisories

Use the security advisory provided by your Linux distribution rather than relying only on the upstream kernel version.

4. Update the kernel

Install the security update supplied by the distribution.

5. Reboot if required

A running kernel continues to use the currently loaded kernel image until reboot.

---

10 — Detection Ideas

Security teams can monitor for unusual kernel behavior associated with the affected subsystem.

Potential indicators include: