Executive brief
The Linux kernel's device mapper (dm) array component, used to manage cache and storage metadata, failed to properly validate metadata block headers during read operations. An attacker with the ability to craft malicious metadata could trigger an out-of-bounds buffer read, potentially causing system crashes or information disclosure affecting data persistence and availability.
Technical details
A missing validation flaw in the dm_array module's array_block_check() function allowed malformed array block headers to bypass safety checks. The vulnerable code failed to validate value_size, max_entries, and nr_entries fields, enabling unguarded pointer arithmetic in element_at() and dm_array_cursor_next() to read beyond dm-bufio buffer boundaries. An attacker providing specially crafted metadata during cache activation (via dm_cache_load_mappings()) could trigger the overflow. The fix adds comprehensive header validation: rejecting zero value_size, enforcing max_entries consistency with block capacity, and requiring nr_entries to fit within max_entries. Patches are available in the Linux kernel stable tree.
Affected products
- Linux Linux kernel Multiple versions prior to patch (commit 2965787723084835b18dfe993cd450ebf5bd4540)
Timeline
- 2026-09-11: disclosed
- 2026-08-04: patched: Fix committed to stable tree
- 2026-07-31: other: Patch authored