Executive brief
A vulnerability was identified in the Linux kernel's data integrity component (dm-verity) that could lead to an out-of-bounds memory read. This component is used to ensure that data on storage devices has not been tampered with. Under specific low-memory conditions and non-standard configurations, the system might incorrectly read data beyond its intended buffer, potentially causing a system crash or instability.
Technical details
An out-of-bounds read vulnerability existed in the `fec_decode_bufs()` function within `drivers/md/dm-verity-fec.c`. The function incorrectly assumed that Reed-Solomon (RS) parity bytes would never be split across parity blocks. In specific configurations (e.g., `fec_roots=17` and `nbufs=1`), the alignment of parity data could result in a request for more bytes than remain in the current block buffer, leading to an out-of-bounds read. This condition is primarily reachable during low-memory scenarios where the maximum number of buffers cannot be allocated. The issue has been resolved by refactoring how parity blocks are read to correctly handle split boundaries.
Affected products
- Linux Linux Kernel Versions using dm-verity FEC unaligned to block size
Timeline
- 2026-02-05: other: Patch authored by Eric Biggers
- 2026-05-28: disclosed: CVE-2026-46130 published