Skip to content
OpenAdvisories
Medium ALAS2-2026-4073 1 CVE

Moderate: lvm2 security update (Amazon Linux 2)

Published Nov 9, 2026 · Updated Nov 9, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-19617: A flaw was found in libdm. A remote attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the metadata to crash. This vulnerability results in a Denial of Service (DoS) for affected systems.

Fixed packages 18

ReleasePackageFixed in
Amazon Linux · 2 cmirror 7:2.02.187-6.amzn2.5.2
Amazon Linux · 2 cmirror-standalone 7:2.02.187-6.amzn2.5.2
Amazon Linux · 2 device-mapper 7:1.02.170-6.amzn2.5.2
Amazon Linux · 2 device-mapper-devel 7:1.02.170-6.amzn2.5.2
Amazon Linux · 2 device-mapper-event 7:1.02.170-6.amzn2.5.2
Amazon Linux · 2 device-mapper-event-devel 7:1.02.170-6.amzn2.5.2
Amazon Linux · 2 device-mapper-event-libs 7:1.02.170-6.amzn2.5.2
Amazon Linux · 2 device-mapper-libs 7:1.02.170-6.amzn2.5.2
Amazon Linux · 2 lvm2 7:2.02.187-6.amzn2.5.2
Amazon Linux · 2 lvm2-cluster 7:2.02.187-6.amzn2.5.2
Amazon Linux · 2 lvm2-cluster-standalone 7:2.02.187-6.amzn2.5.2
Amazon Linux · 2 lvm2-debuginfo 7:2.02.187-6.amzn2.5.2
Amazon Linux · 2 lvm2-devel 7:2.02.187-6.amzn2.5.2
Amazon Linux · 2 lvm2-libs 7:2.02.187-6.amzn2.5.2
Amazon Linux · 2 lvm2-lockd 7:2.02.187-6.amzn2.5.2
Amazon Linux · 2 lvm2-python-boom 7:1.2-2.amzn2.5.2
Amazon Linux · 2 lvm2-python-libs 7:2.02.187-6.amzn2.5.2
Amazon Linux · 2 lvm2-sysvinit 7:2.02.187-6.amzn2.5.2

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-19617.html