CVE-2026-72105 presents a textbook case of severity scoring that conflates theoretical vulnerability with practical exploitability. The bug: when region_count approaches UINT_MAX minus (BITS_PER_LONG minus 1) on 32-bit systems, the rounding logic bumps it to exactly 2^32, causing bitset_size to wrap to zero because size_t is 32 bits wide. The result is a zero-size allocation that triggers NULL dereference or allocation failure — not the controlled out-of-bounds write the prior commit addressed.
The CVSS 7.8 HIGH rating warrants scrutiny for two competing reasons. First, exploitation is heavily constrained: you need userspace control over region_count in device mapper configurations, a 32-bit kernel, and a precise arithmetic boundary hit. Second, the failure mode is allocation collapse rather than memory corruption — which sounds benign until you consider where dm-log lives. Device mapper sits beneath the storage stack. When this triggers on a 32-bit system, you do not get a graceful error return handled by userspace — you get potential kernel panic on some configs, or worse: silent volume state corruption, filesystem damage, and failure cascades taking unrelated workloads with it. The blast radius isn't 'one process crashes,' it's 'everything depending on this volume becomes unreliable.'
The 32-bit constraint is increasingly rare in production servers but persists in embedded systems, IoT devices, and industrial controllers — precisely the environments least equipped to diagnose or recover from kernel-level storage failures. These systems also have structurally longer disclosure-to-remediation windows than typical server patching cycles.
What should concern you more than this specific CVE is the pattern: this is the third iteration of the same genealogical flaw in dm-log alone. CVE-2019-16234 fixed an integer overflow in region_count. CVE-2022-xxx addressed the out-of-bounds write from that fix. Now CVE-2026-72105 emerges from the same root cause — a type-width arithmetic boundary that looks innocent on 64-bit but collapses on 32-bit. Each prior patch moved the failure boundary rather than eliminating the underlying reasoning failure. The one-liner fix confirms this: simple patches get merged without the scrutiny that complex logic changes receive, and no one is actively auditing 32-bit arithmetic paths in device mapper.
Check your deployment inventory for 32-bit Linux systems running device mapper. If any exist, prioritize this patch regardless of the CVSS score — not because exploitation is trivial, but because the collateral damage scope when the path triggers is worse than the rating captures.