Executive brief
A vulnerability was identified in the Linux kernel's device mapper component, which manages storage volumes. An attacker could provide a specially crafted storage configuration string that causes the system to miscalculate memory requirements, potentially leading to a system crash or unauthorized access to sensitive kernel memory. This issue primarily affects the stability and security of systems where users have the ability to configure storage devices.
Technical details
An integer overflow exists in the 'dm mirror' driver within the create_dirty_log() function in drivers/md/dm-raid1.c. The vulnerability occurs when calculating the argument count (*args_used = 2 + param_count) using a user-supplied param_count from a device mapper table string. If param_count is near UINT_MAX, the addition wraps around, bypassing the argc validation check. This overflowed value is subsequently passed to dm_dirty_log_create(), leading to out-of-bounds reads on the argv array. The fix involves validating param_count against (argc - 2) before performing the addition. Patches have been backported to multiple stable kernel branches.
Affected products
- Linux Linux Kernel Introduced in 2.6.12-rc2; fixed in various stable branches including 6.x and 5.x
Timeline
- 2026-03-01: other: Vulnerability fix authored
- 2026-05-27: advisory: CVE-2026-46023 published by NVD
References
- https://git.kernel.org/stable/c/17a08791d428885d00e510864283a7b839792368
- https://git.kernel.org/stable/c/35f6b3281efd44d19110574663bc17a610bc73b9
- https://git.kernel.org/stable/c/47dad9eea75d33212d3d2cea10e7ed6a1bfc0713
- https://git.kernel.org/stable/c/4c788c6f921b22f9b6c3f316c4a071c05683e7de
- https://git.kernel.org/stable/c/87c99a50e0fdc68a5b9b52a94d49452cd3ff02ca