Executive brief
A buffer overflow vulnerability was identified in the Linux kernel's Device Mapper component, which handles storage volume management. Under specific conditions, a system administrator (root user) could trigger a memory error when requesting status information about storage devices. However, the risk is considered minimal because it requires administrative privileges to exploit and standard system libraries are not susceptible to the error.
Technical details
A buffer overflow exists in the dm-ioctl component of the Linux kernel within the retrieve_status function. The vulnerability occurs because the code aligns the 'outptr' variable to an 8-byte boundary without verifying if the alignment moves the pointer beyond the allocated buffer end. If the pointer exceeds the buffer boundary, subsequent calculations for 'remaining' space wrap around to a large value, leading to an out-of-bounds write. Exploitation requires root privileges to issue ioctls. The risk is further mitigated because standard libraries like libdevmapper use 8-byte aligned buffers, preventing accidental triggers. Patches have been merged into multiple stable kernel branches.
Affected products
- Linux Linux Kernel All versions prior to the June 2026 patches
Timeline
- 2026-04-09: patched: Initial fix authored by Mikulas Patocka
- 2026-06-08: advisory: CVE-2026-46294 published
References
- https://git.kernel.org/stable/c/2fa49cc884f6496a915c35621ba4da35649bf159
- https://git.kernel.org/stable/c/448ee8fb79c26a26599ffa4b2adeb4322d3d3d8c
- https://git.kernel.org/stable/c/526ff9126a0ae087b65726e1faf31114c718020d
- https://git.kernel.org/stable/c/5af6a879e915ae7bcd83695c316ebb32e1c61bc2
- https://git.kernel.org/stable/c/8daa6c708ef524089ae43f2aed9190acb26d7df8
- https://git.kernel.org/stable/c/c8c5311237448f6ffeecc9aec2362e3692623668
- https://git.kernel.org/stable/c/d271631023cbe1cbe7c31a0275ab797883be6e0a