Executive brief
The Linux kernel's device-mapper array implementation failed to validate that metadata blocks matched the expected data format, allowing an attacker with the ability to craft malicious metadata to cause out-of-bounds memory access. This could lead to denial of service (kernel crash) or potential privilege escalation on systems using dm-cache storage volumes.
Technical details
A validation bypass in the device-mapper array code (drivers/md/persistent-data/dm-array.c) allowed array blocks with mismatched value_size fields to be processed without proper bounds checking. The vulnerability exists in get_ablock() and __shadow_ablock() functions, which load array metadata blocks but did not verify that the block's value_size matched what the calling code expected. An attacker could craft malicious dm-cache metadata pointing mappings (8-byte entries) to hint blocks (4-byte entries), causing element_at() to stride incorrectly and access memory beyond the 4096-byte block boundary (reaching offset 8160). The fix adds explicit validation rejecting blocks where the stored value_size disagrees with the caller's expected value_type.size, preventing exploitation via crafted metadata on locally accessible storage.
Affected products
- Linux Linux kernel all versions with dm-array (since ~kernel 2.6.35); patch issued 2026-08-04
Timeline
- 2026-09-11: disclosed: CVE published
- 2026-08-04: patched: Upstream fix merged (commit 4538a287bdf5d0f9a379c678e5262b9f5783f547)
- 2026-09-14: advisory: Stable kernel releases updated