CVE-2026-72105: dm-log: fix a bitset_size overflow on 32bit machines

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

dm-log: fix a bitset_size overflow on 32bit machines

Commit c20e36b7631d ("dm log: fix out-of-bounds write due to
region_count overflow") made sure that region_count could fit in an
unsigned int. But the bitmap memory isn't allocated based on
region_count. It uses bitset_size (a size_t variable). The first step of
calculating bitset_size is to set it to region_count, rounded up to a
multiple of BITS_PER_LONG. If region_size is less than BITS_PER_LONG
smaller than UINT_MAX, it will get rounded up to 2^32. On a 32bit
architecture, this will make bitset_size wrap around to 0 and fail,
despite region_count being valid.

Since bitset_size gets divided by 8, it can hold any valid region_count.
It just needs a special case to handle the rollover. If it is 0, the
value rolled over, and bitset size should be set to the number of bytes
needed to hold 2^32 bits.

The Linux kernel CVE team has assigned CVE-2026-72105 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.10.258 with commit 44ab8875ae4a2842bde2d756bed195d375e0debb and fixed in 5.10.261 with commit cdc4ddf9db2cb79f4ab86b1a509b7ac21b0b6cf5
	Issue introduced in 5.15.209 with commit defe483e47173768c227532694dc78cb65db5f09 and fixed in 5.15.212 with commit 4b0de5a3ac1fd42acb0dc1f80ac5747e3287d723
	Issue introduced in 6.1.175 with commit 3ec74da927b4e171a6fc0e77b1188ba4d019af51 and fixed in 6.1.178 with commit 567602fa72d57169365cbc589e0b8c3be900636d
	Issue introduced in 6.6.141 with commit d4ac87567f86a55c3c92e9a5144dcd943a9772a1 and fixed in 6.6.145 with commit d05e0edfecf5260e6dddd28b2f0cce02bfc6ed7a
	Issue introduced in 6.12.91 with commit 12bd5b88e91a02785244ff1d20fb157e96e9cdc8 and fixed in 6.12.97 with commit 1c3412b584e1fb6c665ff33ba7259253bc0082cb
	Issue introduced in 6.18.33 with commit b455903eed4558982be0811f5b7f44f6bbc4ff57 and fixed in 6.18.40 with commit e0b0163a65758ec3a2361ae1cea407898c27f21e
	Issue introduced in 7.1 with commit c20e36b7631d83e7535877f08af8b0af72c44b1a and fixed in 7.1.5 with commit 79feb87ab2396d49b9b65e4bb815d33cc71cba47
	Issue introduced in 7.1 with commit c20e36b7631d83e7535877f08af8b0af72c44b1a and fixed in 7.2-rc3 with commit 9743132a41f4d9d0e54c5f2adcb821b04796bab1
	Issue introduced in 7.0.10 with commit 4ec8323b9f0764a14d532b1ae9b87f8a9fecb867

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72105
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/md/dm-log.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/cdc4ddf9db2cb79f4ab86b1a509b7ac21b0b6cf5
	https://git.kernel.org/stable/c/4b0de5a3ac1fd42acb0dc1f80ac5747e3287d723
	https://git.kernel.org/stable/c/567602fa72d57169365cbc589e0b8c3be900636d
	https://git.kernel.org/stable/c/d05e0edfecf5260e6dddd28b2f0cce02bfc6ed7a
	https://git.kernel.org/stable/c/1c3412b584e1fb6c665ff33ba7259253bc0082cb
	https://git.kernel.org/stable/c/e0b0163a65758ec3a2361ae1cea407898c27f21e
	https://git.kernel.org/stable/c/79feb87ab2396d49b9b65e4bb815d33cc71cba47
	https://git.kernel.org/stable/c/9743132a41f4d9d0e54c5f2adcb821b04796bab1